Showing posts sorted by date for query DHS. Sort by relevance Show all posts
Showing posts sorted by date for query DHS. Sort by relevance Show all posts

Twitter Hacked, More Than 250,000 User Data Compromised

Twitter Hacked, More Than 250,000 User Data Compromised

The social networking giant and the world famous micro blogging site Twitter again fallen victim of cyber attack. Last year we have seen that the tight security system if twitter have been compromised many times. Yet again in this year the San Francisco based social media giant who have more than 500 million registered users failed to protect them selves from hackers. On last Friday Twitter acknowledged that it had become the latest victim in a number of cyber-attacks against media companies, saying hackers may have gained access to information on 250,000 of its more than 200 million active users. The micro blogging giant said in a blog posting that earlier this week it detected attempts to gain access to its user data. It shut down one attack moments after it was detected. According to reports usernames, email addresses, session tokens and encrypted/salted passwords for 250,000 users might have been accessed in what it described as a “sophisticated attack” 

"This attack was not the work of amateurs, and we do not believe it was an isolated incident,” said Bob Lord, Twitter’s director of information security. “The attackers were extremely sophisticated, and we believe other companies and organisations have also been recently similarly attacked” Bob added. 

Jim Prosser, a Twitter spokesman, would not say how hackers infiltrated Twitter’s systems, but Twitter’s blog post said hackers had broken in through a well-publicized vulnerability in Oracle’s Java software. Last month, after a security researcher exposed a serious vulnerability in the software, though Oracle patched the security hole, but Homeland Security said the fix was not sufficient. The DHS issued a rare alert that warned users to disable Java on their computers. Prosser said Twitter was working with government and federal law enforcement to track down the source of the attacks. For now, he said the company had reset passwords for, and notified, every compromised user. The company encouraged users to practice good password hygiene, which typically means coming up with different passwords for different sites, and using long passwords that cannot be found in the dictionary.
Twitter said it “hashed” passwords — which involves mashing up users’ passwords with a mathematical algorithm — and “salted” those, meaning it appended random digits to the end of each hashed password to make it more difficult, but not impossible, for hackers to crack. Once cracked, passwords can be valuable on auction-like black market sites where a single password can fetch $20.

While talking about Twitter and cyber issues, I would like to remind you that in last year twitter faced several cyber attacks where more than 55,000 twitter account details was leaked, after this issue in the middle of last year the social networking giant faced massive denial of service which interrupted its services. Later a huge number of Twitter users across the globe received  emails warning that their account have been compromised and their passwords had been reset, and it was another security breach which affected twitter. Such big organization are not at all careless about security, so as twitter and it has been proved when they hired renowned white hat hacker Charlie Miller to boost up their security, but after this current massacre, it seems that twitter need to think more and emphasize a lot to make sure that their system is good enough to prevent cyber attacks. For all the hot cyber updates and reviews stay tuned with VOGH.




SHARE OUR NEWS DIRECTLY ON SOCIAL NETWORKS:-

DHS & US-CERT Recommended to Disable Java in Web Browsers

DHS & US-CERT Recommended to Disable Java in Web Browsers Unless It's Absolutely Necessary

The running time is proving to be the worst period for Java, as it has been walking under serious security issues. Yet again security researchers have pointed out a zero-day security vulnerability in the Java program that hackers are exploiting. The exploit takes advantage of a vulnerability left open in Java 7 Update 10, released in October last year. It works by getting Java users to visit a website with malicious code that takes advantage of a security gap to take control of users' computers. Thus how Java is being used by cyber criminals to infect computers with malware. Oracle, hasn't specified the number of users who have downloaded Java 7 Update 10. However, Java runs on more than 850 million computers and other devices. When Oracle released Update 10, so it is predictable that more than 850 million devices run by Java is under threat. The exploit was first discovered by French researcher Kafeine, who claimed to have found it running on a site registering hundreds of thousands of page views daily. From that site, immediately that vulnerability and a large number of effected devices has been spotted in the wild. In Java 7 Update 10 the creator of Java, Oracle added several security control and fixed older bugs and promised more security enhancement, but its very unfortunate that Oracle failed to keep their promise. What ever after this newly discovered 0-day hole spotted wildly, Oracle Security Alert CVE-2013-0422 states that Java 7 Update 11 addresses this (CVE-2013-0422) and an equally severe, but distinct vulnerability (CVE-2012-3174). Immunity has indicated that only the reflection vulnerability has been fixed and that the JMX MBean vulnerability remains. Java 7u11 sets the default Java security settings to "High" so that users will be prompted before running unsigned or self-signed Java applets. It "strongly recommends" that Java SE 7 users upgrade immediately to avoid all kind of security hazards. 

After seeing all the drama, many of you have failed to keep trust in Java, and you all will be relieved when you will gone through the security advisory of CERT (Computer Emergency Response Team) where they have clearly instructed to disable Java in your popular web-browser. In their official release CERT said "Unless it is absolutely necessary to run Java in web browsers, disable it as described below, even after updating to 7u11. This will help mitigate other Java vulnerabilities that may be discovered in the future."

You will see similar advice in the advisory posted on the official DHS US-CERT website where DHS also suggested to disable Java until and unless it is that much necessary. "To defend against this and future Java vulnerabilities, consider disabling Java in web browsers until adequate updates are available. As with any software, unnecessary features should be disabled or removed as appropriate for your environment." - said U.S. CERT in their advisory. 






SHARE OUR NEWS DIRECTLY ON SOCIAL NETWORKS:-

#ProjectWhiteFox -Team GhostShell Hacked 1.6 Million Accounts of NASA, ESA, Pentagon & FBI

#ProjectWhiteFox -Team GhostShell Hacked 1.6 Million Accounts of NASA, ESA, Pentagon & FBI

After the devastating "Project Blackstar" now the hacktivist group calling them selves "Team GhostShell" announced another big hack, where the hackers have targeted several big organizations. This round of cyber attack was going under the banner of #ProjectWhiteFox, in which GhostShell has posted log-in details of 1.6 million accounts they claim are taken from a series of attacks on organizations including NASA, FBI, European Space Agency and Pentagon, as well as many companies that partner with these organizations. The Anonymous subsidiary group has posted the details on Pastebin, while describing the aim of the hack; as part of their #ProjectWhiteFox campaign to promote hacktivism and freedom of information on the internet. The hacker group claimed that the leaked information contained log-in names, passwords, email addresses, CV & several other sensitive information. In their release GhostShell said - "For those two factors we have prepared a juicy release of 1.6 million accounts/records from fields such as aerospace, nanotechnology, banking, law, education, government, military, all kinds of wacky companies & corporations working for the department of defense, airlines and more."
GhostShell members also said that they have messaged security bosses about the insecurity a number of organizations they targeted during attacks throughout 2012, describing it as "an early Christmas present." 
In a Pastebin file, GhostShell features a list of 37 organizations and companies, including The European Space Agency, NASA’s Engineers: Center for Advanced Engineering, and a Defense Contractor for the Pentagon. GhostShell sets itself apart from other hacktivist groups by targeting more than just one company or organization, and then releasing the results of its attack all at once. This set of hacks is spread out across 456 links, many of which simply contain raw dump files uploaded to GitHub and mirrored on paste sites Slexy.org and PasteSite.com.
The uploaded files contain what appears to be user data that looks to have been obtained from the servers of the various firms (likely via SQL injection). The entries include IP addresses, names, logins, email addresses, passwords, phone numbers, and even home addresses. Email accounts include the big three (Gmail, Hotmail, and Yahoo), as well as many .gov accounts. There are also various documents and material related to partnerships between companies and government bodies, as well as sensitive information for the aforementioned industries. 
Furthermore, the group says it has sent an email to the ICS-CERT Security Operations Center, Homeland Security Information Network (HSIN), Lessons Learned and Information Sharing (LLIS), the FBI’s Washington Division and Seattle location, Flashpoint Intel Partners, Raytheon, and NASA. In it, they say to have detailed “another 150 vulnerable servers from the Pentagon, NASA, DHS, Federal Reserve, Intelligence firms, L-3 CyberSecurity, JAXA, etc.”





-Source (TNW)






SHARE OUR NEWS DIRECTLY ON SOCIAL NETWORKS:-

DHS & Public Safety Canada Started Joint Cybersecurity Action Plan

DHS Public Safety Canada Started Joint Cybersecurity Action Plan

A joint venture Cyber Security plan has been announced by US Department of Homeland Security and Canada. According to the official website of Public Safety Canada - PS Canada along with the Department of Homeland Security (DHS) are pursuing a coordinated approach to enhance the resiliency of our cyber infrastructure. The Cybersecurity Action Plan (the Action Plan) between PS and DHS seeks to enhance the cybersecurity of our nations through increased integration of PS' and DHS' respective national cybersecurity activities and improved collaboration with the private sector. This Action Plan represents just one of many important efforts between Canada and the United States to deepen our already strong bilateral cybersecurity cooperation.
As the Internet knows no borders, all countries have a responsibility to prevent, respond to, and recover from cyber disruptions and to make cyberspace safer for all citizens across the globe. Due to a shared physical border, Canada and the United States have an additional mutual interest in partnering to protect our shared infrastructure. This Action Plan aims to articulate a shared approach to fulfill PS' and DHS' vision of working together to defend and protect our use of cyberspace and to strengthen the resiliency of our nations. These efforts, combined, advance the objectives articulated by President Obama and Prime Minister Harper in the February 2011 declaration, Beyond the Border: A Vision for Perimeter Security and Economic Competitiveness.
This Action Plan outlines three goals for improved engagement, collaboration, and information sharing at the operational and strategic levels, with the private sector, and in public awareness activities, for activities conducted by PS and DHS. The Action Plan establishes lines of communication and areas for collaborative work critical to enhancing the cybersecurity preparedness of both nations. The Action Plan's goals and objectives are to be conducted in accordance with the June 2012 Statement of Privacy Principles by the United States and Canada. This Action Plan is intended to remain a living document to be reviewed on a regular basis and updated as needed to support new requirements that align to the Plan's key goals and objectives. It intends to support and inform current and future efforts to advance the goals of Beyond the Border, which ultimately seeks to enhance broad bilateral cooperation on cybersecurity efforts across both governments.

Goals and Objectives:-

1. Enhanced Cyber Incident Management Collaboration between National Cybersecurity Operations Centers

PS' Canadian Cyber Incident Response Centre intends to work jointly with DHS' United States Computer Emergency Readiness Team and Industrial Control Systems Cyber Emergency Response Team towards the following objectives:
  • 1.1 Increase real-time collaboration between analysts by improving existing channels for remote communication and arranging in-person visits;
  • 1.2 Enhance information sharing at all classification levels and collaborate on training opportunities, while promoting inter-agency coordination, as appropriate, as well as the proper protections for information, as outlined in the Statement of Privacy Principles;
  • 1.3 Coordinate on cybersecurity incident response management, relating to defense, mitigation, and remediation activities and products, including with other public and private entities consistent with each country's laws and policies;
  • 1.4 Align and standardize cyber incident management processes and escalation procedures; and
  • 1.5 Enhance technical and operational information sharing in the area of industrial control systems security.

2. Joint Engagement and Information Sharing with the Private Sector on Cybersecurity

Due to the shared nature of critical infrastructure between Canada and the United States, PS and DHS intend to collaborate on cybersecurity-focused private-sector engagement for cybersecurity activities for which they are responsible through the following objectives:
  • 2.1 Share engagement approaches for private sector;
  • 2.2 Exchange and collaborate on the development of briefing materials for the private sector;
  • 2.3 Jointly conduct private sector briefings;
  • 2.4 Review approaches and align processes for private sector engagement through requests for technical assistance and non-disclosure agreements; and
  • 2.5 Standardize protocols for sharing information.

3. Continued Cooperation on Ongoing Cybersecurity Public Awareness Efforts

Cybersecurity is a shared responsibility and everyone, including our citizens, has a role to play. With increased media attention devoted to cybersecurity incidents and with the continuing growth of electronic commerce and social media, it is imperative that citizens receive clear and trustworthy information on how to manage cyber threats to themselves and their families. Ensuring that government's cybersecurity awareness messages are consistent across our border helps to deliver that information effectively and consistently. PS Communications, the DHS Office of Public Affairs, and the National Protection and Program Directorate's Office of Cybersecurity and Communications (CS&C) intend to continue to work together as they:
  • 3.1 Collaborate on public awareness campaigns (websites, social media activities, education material, etc.);
  • 3.2 Collaborate on Cybersecurity Awareness Month (October); and
  • 3.3 Share and coordinate messaging on issues of common interest.

Governance of the Joint Action Plan:-

Senior officials within PS and CS&C intend to review and provide additional guidance in order to update this Action Plan on a quarterly basis. This Action Plan is intended to be a part of broader inter-governmental coordination across government agencies in both the United States and Canada.


To Download The Full Cybersecurity Action Plan Between Public Safety Canada and the Department of Homeland Security Click Here



SHARE OUR NEWS DIRECTLY ON SOCIAL NETWORKS:-

Cyber Security Summit Hosted By Department of Homeland Security (DHS)

Cyber Security Summit Hosted By Department of Homeland Security (DHS) 

As part of the national Stop.Think.Connect campaign against cyber threats to computers in the private and public sector, the city of Mesa and the Department of Homeland Security are hosting a cyber security summit at the Mesa Arts Center on Wednesday, Sept. 26. The mayor of Mesa said on Wednesday that interest in the summit is growing, and that there also will be numerous representatives of government from throughout the state and a member of the Secret Service attending the event.  Kelvin Coleman, U.S. Department of Homeland Security director of state, local, tribal and territorial cyber engagement, will be the keynote speaker. Mesa Mayor Scott Smith and District 3 councilman and Mesa Public Safety Committee chair Dennis Kavanaugh also will offer comments and help to facilitate questions during the event. “We use computers every day,” Smith said. “We don’t know how important computers are until they’re breached.”


Date: September 26, 2012

1 E. Main Street
Mesa, AZ  85201 


7:30 a.m. Registration & Continental Breakfast sponsored by Siemens

8:30 a.m. Welcome and Opening Remarks

  • Mayor Scott Smith
  • Councilmember Dennis Kavanaugh

9:00 a.m. Keynote Address

  • Mr. Kelvin Coleman, Director, State, Local, Tribal and Territorial Cybersecurity Engagement Program DHS National Cyber Security Division

9:30 a.m. Convenience vs. Security Expert Panel
Current Threats in an increasingly Networked World Panelist Bios
John Meza (Moderator), Assistant Chief, Mesa Police Department
James Choplin, Special Agent, Electronic Crimes Task Force, U.S. Secret Service
Dr. Dee H. Andrews, Ph.D. Senior Research Psychologist, Army Research Institute for the Behavioral and Social Sciences
Kristy Westphal, Director of Security Operation, T-Systems North America
Lonnie Benavides, Red Team Lead, The Boeing Company
Ilene Klein, City of Phoenix Office of Information Security and Privacy
Bill Kalaf, Executive Director - Intelligence-Led Policing, Mesa Police Department
 
During this session, the panel will outline and discuss many of the current threats affecting businesses, local government, users, such as social engineering, security of mobile devices and many of the trending applications on smart phones and PCs.
   
10:30 a.m. Networking Break
   
10:45 a.m. Closing Remarks

  • Mayor Scott Smith

11:15 a.m. Adjournment
   
11:30 a.m. Post CyberSecurity Summit Break Out Session:  Methods for training supervisors to detect behavioral indicators of insider threat

Dr. Dee H. Andrews 
Senior Research Psychologist , U.S. Army Research Institute for the Behavioral and Social Sciences 
During this session, participants will get an overview of methods in training supervisors to spot and mitigate the cyber insider threat.  Statistics reveal that approximately 40% of the cyber incidents are caused by insiders.  

If you want to register for the U.S. Department of Homeland Security Cyber Security Summit then click Here. For additional information about Stop.Think.Connect. click Here


-Source (mesaaz.gov)









SHARE OUR NEWS DIRECTLY ON SOCIAL NETWORKS:-

DHS Issues Malware Warning Impersonating FBI & US Cyber Command


DHS Issues Malware Warning Impersonating FBI & US Cyber Command

If you think that only innocent computer users are just the only target of cyber criminals, then you are absolutely wrong. Recently United States Computer Emergency Readiness Team, widely known as US-CERT; which is a part of Depertment of Homeland Security's (DHS) National Cyber Security Division has issued an emergency alert wile announcing a new effort by cyber criminals to spread Malware that impersonates Federal law enforcement (FBI) and other government agencies. The malware is a malicious software that installs itself on a users computer without a users permission or knowledge, “displays a screen claiming that a Federal Government agency has identified the user’s computer as being associated with one of more crimes,” reports the US-CERT alert. Explaining further, the malware then instructs the victim “to pay a fine to regain the use of the computer, usually through prepaid money card services.” The appearance of the message displayed on a users screen is intended to seem like a legitimate and official looking warning from the FBI or US Cyber Command. In turn, the impersonation effort by the cyber criminals seeks to leverage this to scare victims into paying the so-called fine immediately.
“Affected users should not follow the payment instructions,” US-CERT recommends, adding, “Users may also choose to file a complaint with the FBI’s Internet Crime Complaint Center.” 


In their release US-CERT states:-
“US-CERT is aware of multiple malware campaigns impersonating multiple U.S. government agencies, including the United States Cyber Command (USCYBERCOM) and the Federal Bureau of Investigation (FBI). Once installed on a system, the malware displays a screen claiming that a Federal Government agency has identified the user's computer as being associated with one or more crimes. The user is told to pay a fine to regain the use of the computer, usually through prepaid money card services.”








SHARE OUR NEWS DIRECTLY ON SOCIAL NETWORKS:-

Researcher Security Hole Found in US Power Plants, DHS is Investigating

Researcher Security Hole Found in US Power Plants, DHS is Investigating  

Security researcher figure out seirous flaws in software for specialized networking equipment from Siemens could enable hackers to attack US power plants and other critical systems. A security expert said that he had found a backdoor in hardware from a Siemens subsidiary. The alleged flaw was made public by security researcher Justin W Clarke at a conference in Los Angeles. The equipment is widely used by power companies mainly based on US. Clarke said that the discovery of the flaw is disturbing because hackers who can spy on communications of infrastructure operators could gain credentials to access computer systems that control power plants and other critical systems. "If you can get to the inside, there is almost no authentication, there are almost no checks and balances to stop you," Clarke said.
The Department of Homeland Security said it was in contact with the firm to assess the claim. After this issue came in-front, the US Govt immeditely taken stpes & investigating the whole scenario. RuggedCom, a Canadian subsidiary of Siemens that sells networking equipment for use in harsh environments such as areas with extreme weather, said it was investigating Clarke's findings, but declined to elaborate. This is the second bug that Clarke, a high school graduate who never attended college, has discovered in products from RuggedCom, which are widely used by power companies that rely on its equipment to support communications to remote power stations.
In May, RuggedCom released an update to its Rugged Operating System software after Clarke discovered that it had a previously undisclosed "back door" account that could give hackers remote access to the equipment with an easily obtained password. The Department of Homeland Security's Industrial Control Systems Cyber Emergency Response Team, which is known as ICS-CERT, said in its advisory on Tuesday that government analysts were working with RuggedCom and Clarke to figure out how to best mitigate any risks from the newly identified vulnerability. "According to this report, the vulnerability can be used to decrypt SSL traffic between an end-user and a RuggedCom network device," Read the full advisory. 

This is not the first time, earlier in 2011 - researcher found vulnerability in the security system of US Power Grid, form which NSA suspected that hacktivist Anonymous may even shutdown the entire US Power Grid. later The White House introduced an Electric Sector Cybersecurity Risk Maturity ModelFor these kind of cyber security updates & news, just stay tuned with VOGH


-Source (Reuters & BBC)






SHARE OUR NEWS DIRECTLY ON SOCIAL NETWORKS:-

DHS Outlines $202 Million To Continuously Monitor Their Computers & Networks For Security Threats

DHS Outlines $202 Million To Continuously Monitor Their Computers & Networks For Security Threats

People like you, me or us those who are directly involved or associated in this security domain knows very well that cyber crime is in a saturated situation. Since last 3-4 years hackers have broken almost 99%, It's already became an International issue. Every day the said security system is getting compromised. To fight against this burning issue the Department of Homeland Security has outlined another program costs more than $202 million to arm federal agencies with new tools to continuously monitor their computer networks for security threats. Contracts for monitoring services will be awarded as early as next year. The tools will enable agencies to monitor their systems every 24 to 72 hours, and to diagnose and prioritize the biggest security weaknesses. Such programs are already in operation at two agencies, the State and Justice departments.
When it comes to continuous monitoring capabilities, “we are a little bit uneven across [the] dot-gov” domain, said John Streufert, director of DHS’ National Cybersecurity Division.
The tools will help agencies be aware of all hardware and software that has access to their networks and ensure they meet security standards. They also will continuously scan their networks for vulnerabilities so they can be quickly addressed when they appear. The tools will include dashboards that present to IT officials snapshots of their networks’ security status to enable quick response in the event a vulnerability. Agencies will have the option of providing their own monitoring using DHS-provided tools; purchasing a monitoring service from another agency or contractor; or obtaining a monitoring service for cloud-based systems from their cloud service providers.








SHARE OUR NEWS DIRECTLY ON SOCIAL NETWORKS:-

Department of Homeland Security (DHS) Said -Cyber Crime is As Threatening As al Qaeda

Department of Homeland Security (DHS) Said -Cyber Crime is As Threatening As al Qaeda

The number of organized cyber crime has already kisses the sky. Keeping this scenario in mind Janet Napolitano, Secretary of Homeland Security, said that "the greatest threats in actual activity we've seen aimed at the West and the United States has been in the cyber-arena", in addition to "al Qaeda and al Qaeda-related groups" The comments highlight the increasing trend of political sparring and espionage proliferating on the Web. The Flame virus, believed to be driven by a western government, continues to grab headlines, while he also claimed that Google has introduced a tool to warn users of state-sponsored attacks on their accounts. Though gmail completely denied this blame while saying that Govt hired State-Sponsored attackers who ware accessing millions of Gmail accounts illegally
Napolitano also said the government is taking steps to be "proactive instead of reactive" in combating the new threats, adding that the worldwide cost of tackling cyber-crime - an estimated $388 billion (£250 billion) - is "already outstripping [the cost of tackling] traditional narcotics". 
A White House plan code-named Olympic Games was launched to infect Iran's nuclear program at the beginning of the Obama administration, though Washington denies the Flame virus, also targeting Iran, was part of the project, after it was found to have existed for a number of years.


-Source (IT Portal)
.




SHARE OUR NEWS DIRECTLY ON SOCIAL NETWORKS:-

Cyber-Attack on US Natural Gas Pipeline Companies Network, Said DHS

Cyber-Attack on US Natural Gas Pipeline Companies Network, Said DHS

In a report Department of Homeland Security (DHS) said a major cyber attack is currently under way aimed squarely at computer networks belonging to US natural gas pipeline companies. DHS has issued at least three confidential warnings at the second highest alert level (Amber) to natural gas suppliers, giving a detailed warning of a wave of attacks. But the wave of cyber attacks, which apparently began four months ago – and may also affect Canadian natural gas pipeline companies – is continuing. That fact was reaffirmed late Friday in a public, albeit less detailed, "incident response" report from the Industrial Control Systems Cyber Emergency Response Team (ICS-CERT), an arm of DHS based in Idaho Falls, Idaho. It reiterated warnings in the earlier confidential alerts made directly to pipeline companies and some power companies. The attacks are said to have been carried out using spear-phishing techniques, in which criminals use specially crafted virus-infected emails to target specific company employees. 
Approximately 200,000 miles of these interstate natural gas transmission pipelines in the US supply 25 percent of the nation's energy. Pipeline safety has been a major issue in recent years, highlighted by the San Bruno, Calif. In Friday's public warning, ICS-CERT reaffirms that its "analysis of the malware and artifacts associated with these cyber attacks has positively identified this activity as related to a single campaign from a single source." It goes on to broadly describe a sophisticated "spear-phishing" campaign – an approach in which cyber attackers attempt to establish digital beachheads within corporate networks.




SHARE OUR NEWS DIRECTLY ON SOCIAL NETWORKS:-

Homeland Security Approved Cyber security Bill "PRECISE" (H.R. 3674)

Homeland Security Approved Cyber security Bill "PRECISE" (H.R. 3674)

The House Homeland Security Committee approved H.R. 3674, the Promoting and Enhancing Cybersecurity and Information Sharing Effectiveness Act of 2011 (the PRECISE Act) by voice vote, after a lengthy mark-up session that saw the bill’s scope scaled back. This Cybersecurity bill was approved on April 18 aimed at securing federal information systems and helping private sector critical infrastructure owners/operators, but key committee members complained that its watered-down provisions weren’t adequate. The bill, originally introduced by Rep. Dan Lungren (R-CA) in February had aimed to create a national information sharing organization to oversee the cyber protection of critical infrastructure, but will now only authorize the National Cybersecurity and Communications Integration Center (NCCIC) at the Department of Homeland Security (DHS).
The committee’s ranking member, Rep. Bennie Thompson (D-MS), bitterly objected to the changes, saying they essentially gutted the bill. In a statement following the bill’s mark-up, he said it “bears little resemblance to the measure that the Cybersecurity Subcommittee approved in February.” He said key provisions that promoted information sharing between and among the private sector and government and privacy protections were removed behind closed doors by the committee’s leadership.


-Source (Govt. Security News)


SHARE OUR NEWS DIRECTLY ON SOCIAL NETWORKS:-

Department of Homeland Security & U.S. Navy Hires Company To Hack Into Video Game Consoles

Department of Homeland Security & U.S. Navy Hires Company To Hack Into Video Game Consoles 

The U.S. government has hired a California-based company to hack into video game consoles, such as Xbox 360 and PlayStation 3, to watch criminals, especially child predators, and learn how to collect evidence against them. The $177,000 contract with Obscure Technologies of San Rafael, Calif., is being executed by the U.S. Navy on behalf of the Department of Homeland Security because of the Navy’s expertise in the field, officials said. Under the contract, Obscure Technologies will purchase used gaming systems from abroad that are believed to hold “sensitive information from previous users” and try to hack into them. Obscure’s experts will then report back on how they gained access to the systems, provide instructions to obtain users’ chat room activity, and even report back on the data gleaned, according to the contract and tasking documents. Obscure will also purchase new systems and construct a device that can capture data and activity, the documents state.
Over the past few decades, video game systems have grown in sophistication and capabilities by leaps and bounds. Consoles like the Nintendo Wii, Sony PlayStation 3, and Microsoft Xbox can be found in many U.S. households and are popular among servicemembers, with Internet access and hard drives that rival personal computers.
With these advances, Garfinkel said, the systems have become a playground of illegal activity for criminals. In 2008, law enforcement agencies contacted the DHS’s Science and Technology Directorate and requested help in analyzing gaming systems seized during court-authorized searches, Garfinkel said. While some tools exist to extract data from gaming consoles, the consoles are hard to crack as they are designed with copyright protection systems, he said. Navy and DHS officials declined to comment on whether the gaming consoles of Americans will ever be hacked and monitored. They also declined to comment as to whether the system manufacturers had been approached about this research.


-Source (Stars & Stripes)


SHARE OUR NEWS DIRECTLY ON SOCIAL NETWORKS:-

The White House Introduced- Electric Sector Cybersecurity Risk Maturity Model



The White House has launched a new initiative designed to help companies in the electric power industry measure the maturity of their security programs against a new maturity model. The program is being run in tandem with the Department of Homeland Security and Department of Energy and is meant to help the utility companies find their weak spots and where they need to improve.
The Electric Sector Cybersecurity Risk Maturity Model Pilot is the first such program launched by the White House, which has been pointing to information security--and specifically the security of systems running utilities and critical infrastructure--as a priority since the beginning of the Obama administration. The administration has developed a number of strategies and policy documents in the last few years, but this is the first foray into the kind of maturity model that typically is seen in private industry.
The White House, DHS and Energy launched the initiative last week with a meeting of government officials and executives from electric companies to discuss the main problems facing the industry when it comes to information security.
In his blog Howard Schmidt, the White House cybersecurity coordinator, said -
"This initiative -- the Electric Sector Cybersecurity Risk Maturity Model Pilot -- is a new White House initiative led by the Department of Energy, in collaboration with the Department of Homeland Security, to develop a model to help us identify how secure the electric grid is from cyber threats and test that model with participating utilities. Gaining knowledge about strengths and remaining gaps across the grid will better inform investment planning and research and development, and enhance our public-private partnership efforts," 

More More Information Click Here


-Source (threatpost)






SHARE OUR NEWS DIRECTLY ON SOCIAL NETWORKS:-

EPIC Sues DHS Is Monitoring Suspicious Words on Social Networks



The Electronic Privacy Information Center (EPIC), has filed suit in US District Court against the Department of Homeland Security. The grounds for the suit is a refusal by DHS to reply to a Freedom of Information Act request filed by EPIC in April of this year.
According to EPIC’s Press Release the center of the issue is a plan by DHS to create fake accounts on social networking sites and use those accounts to monitor the networks for certain key words – such as “drill,” “infection,” “strain,” “virus,” “trojan,” and others. The complaint was filed in the District of Columbia, and asks the court to compel DHS to process EPIC’s FOIA request, as well as to order DHS to produce the records EPIC has requested, to acknowledge EPIC as news media, and to pay EPIC’s legal bills for the suit.
The impetus for EPIC’s request was an announcement by DHS that it planned to implement a Social Media Monitoring and Situation Awareness Initiative, whereby it would monitor social media sites in order to gain realtime information on events. The DHS announcement states that the goal of the initiative is not to collect personally identifiable information except in extreme cases – e.g., a person trapped in rubble with their mobile phone who is posting their status (as happened during the Japanese tsunami).







SHARE OUR NEWS DIRECTLY ON SOCIAL NETWORKS:-

Department of Homeland Security (DHS) Unveils Cybersecurity Bill



Members of the House Homeland Security Committee unveiled legislation Thursday that would authorize the cybersecurity functions of the Department of Homeland Security (DHS) and establish a quasi-governmental entity to coordinate cybersecurity information-sharing with the private sector. The bill, called the Promoting and Enhancing Cybersecurity and Information Sharing Effectiveness Act (PrECISE), would station a national clearinghouse for information relating to potential attacks on critical infrastructure, such as electric grid, water facilities, and financial service systems.
"The risk of cyberattack by enemies of the United States is real, is ongoing and is growing," warned Homeland Security Committee Chairman Peter King (R-N.Y., above left). "The PrECISE Act, in line with the framework set forth by the Speaker’s Cybersecurity Task Force led by Rep. [Mac] Thornberry [R-Texas], protects our critical infrastructure without a heavy-handed and burdensome regulatory approach that could cost American jobs."
Under Section 226 of the bill, the Secretary of Homeland Security "is authorized to maintain the capability to act as the focal point for cybersecurity through technical expertise and policy development." Further, the Secretary is ordered to "coordinate cybersecurity activities across the Federal Government, designate a lead cybersecurity official within the Department of Homeland Security, publish a cybersecurity strategy and provide appropriate reports to Congress."
In effect, the DHS would identify cybersecurity risks on a sector-by-sector basis and gather existing performance standards to procure the most efficient methods to mitigate identified exposures. The Secretary will review and collect standards and publish cyber-defense information for owners and operators of "covered critical infrastructure," which is defined as the "infrastructure that if destroyed or disabled would result in a significant number of deaths, cause mass evacuations, major disruptions of the economy, or significant disruption to national security."
"Cybersecurity is truly a team sport, and this bill gives DHS needed authorities to play its part in the federal government’s cybersecurity mission and enables the private sector to play its part by giving them the information and access to technical support they need to protect critical infrastructure," said Rep. Dan Lungren (R-Calif.), Chairman of the House Cybersecurity Subcommittee.
In addition to Reps. King and Lungren, the bill’s original co-sponsors include Rep. Michael McCaul (R-Texas), Rep. Gus Bilirakis (R-Fla.), Rep. Candice Miller (R-Mich.), Rep. Tim Walberg (R-Mich.), Rep. Billy Long (R-Mo.), Rep. Tom Marino (R-Pa.) and Rep. Bob Turner (R-N.Y.) of the Homeland Security Committee, as well as Rep. Steve Stivers (R-Ohio) and Rep. Jim Langevin (D-R.I.).
One key tenet of the legislation is the creation of the National Information Sharing Organization (NISO), a quasi-governmental entity that would be staged as a clearinghouse for exchanging relevant information regarding cyber threats and vulnerabilities. The organization would be a nonprofit entity consisting of a DHS-appointed board of directors, composed of members from five different federal agencies and 13 members of the private sector.

According to Section 242 of the bill, the NISO Would Have Three Primary Missions:-

First, facilitating the exchange of cyber threat information, best practices and technical assistance amongst its membership including the Government. Second, it would facilitate the creation of a common operating picture built from information contributed by technically sophisticated members such as the Government, Internet Service Providers, and other members with access to large amounts of network related information. Third, the NISO would act as a catalyst for cooperative research and development of member driven research projects. Additionally, the NISO would incorporate into its membership agreements for the transferability of intellectual property and integrate with the National Cybersecurity and Communications Integration Center at DHS.

All in all, NISO’s purpose would be to establish a point of connection between the government and the private sector to pool information about potential cybersecurity threats and to collaborate on methods to prevent such threats from occurring.
While cybersecurity laws have brought a rare agreement between Republicans and Democrats, the two parties have quibbled over certain aspects of the legislation. Generally, House Republicans prefer more limited regulation and discretional incentives to ramp up securities, while Senate Democrats and the White House have suggested more stringent regulations monitored by the DHS.



SHARE OUR NEWS DIRECTLY ON SOCIAL NETWORKS:-

U.S. Water Supply System Under Cyber Attack, FBI & DHS is Investigating


Hackers from Russia have has allegedly remotely intruded into the industrial control systems of a hydroelectric power plant in the US state of Illinois. Reports in the US media say that the hacker managed to repeatedly switch the pump on and off, destroying it in the process. This would be the first time that parts of a country's critical infrastructure have been successfully attacked and crippled via the internet.
Although the FBI and DHS started to investigate the incident, they initially downplayed the risk – this provoked the alleged hacker, "prof", who proceeded to intrude into a second water utility in Houston, Texas. To prove his intrusion, he released five screenshots of the utility's SCADA (Supervisory Control And Data Acquisition) system. 

After an investigation it was determined the system had been hacked into from a computer in Russia, the Washington Post reports.
An Illinois state fusion centre report on the attack said it is not known how many other systems might be affected.
The Department of Homeland Security confirmed that a water plant in Springfield, Illinois, had been damaged. He said: 'DHS and the FBI are gathering facts surrounding the report of a water pump failure in Springfield, Illinois.
'At this time there is no credible corroborated data that indicates a risk to critical infrastructure entities or a threat to public safety.'
A report from the Illinois terrorism and intelligence center said there had been problems with the system in Springfield for two to three months.
The system 'would power on and off, resulting in the burnout of a water pump,' the report said.
It added that cyber attackers broke into a software company’s database and got hold of user names and passwords of various control systems that run water plant computer equipment. The method used, hacking a security company to gain entry to another company, was employed earlier this year by cyber attackers in China.
They stole data from RSA, a division of EMC that provides secure remote computer access to government agencies. They then went on to get into the computer systems of companies, including Lockheed Martin.



SHARE OUR NEWS DIRECTLY ON SOCIAL NETWORKS:-

Cyber Atlantic 2011


Cyber security remains a potential risk mitigation event for all individuals, communities, organizations and governments who rely on the Internet.  This global village of users continues to review, re-evaluate and re-position defensive strategies against this cybersecurity risk arena — with the Cyber Atlantic 2011 cyber security exercise being the latest event to take place.
The Cyber Atlantic exercise 2011 is part of the ongoing EU-U.S. partnership to strengthen mutual capabilities for addressing emerging threats to global networks. Through the EU-U.S. Working Group on Cybersecurity – including representatives from DHS’ National Cyber Security Division (NCSD), the Department of Justice, EU member states and the European Commission – stakeholders focus on cyber incident management, enhancing public-private partnerships, and raising awareness about cyber threats, and combating cybercrime. Two hypothetical scenarios were tested in Cyber Atlantic 2011: a cyber-attack which attempted to extract and publish online sensitive information from the EU’s national cyber security agencies, and an attack on supervisory control and data acquisition (SCADA) systems in EU power generation equipment



SHARE OUR NEWS DIRECTLY ON SOCIAL NETWORKS:-

DHS Bulletin: Anonymous & Associated Hacker Groups Deploying New Cyber Attack Tools


Department of Homeland Security (DSH) released a new bulletin A-0011-NCCIC -120020110914  (U//FOUO) saying that Anonymous and Associated hackers groups are developing and deploying new cyber attack tools. The bulletin contains brif of Anon, Their attacks on the Internet, cyber attack tools, exploits (LOIC, #RefRef, Apache Killer, URGE, Anonware) and so on. 

For More information and to download the bulletin Click Here






SHARE OUR NEWS DIRECTLY ON SOCIAL NETWORKS:-

Team Ghost Released Tax Records of Brazilian Govt, Exclusive Documents of #op-SouthAfrica & 10K SQL- Vulnerable Sites


Black Hat Ghost is back again with boom. Previously they exposed the secrete documents of DOD, NATO, NSA, DHS and many more. This time they exposed the entire tax record of Brazilian Govt. Also Team Ghost published a documents containing more  than 10,000 SQL-i vulnerable sites and their details.
Not yet completed Team Ghost was running an operation named #opSouthAfrica and in this operation they have hacked into 50+ high profile websites of South-Africa including Govt. and so on.


According to The Official Press Release:- 

Today I posted 3 Mediafire links
First link containing:
Tax records from www.balbinos.sp.gov.br From 2002-2011. I exposed everything they've purchased
in the last 9 years. ;)

Second link containing:

The whole contents of #opSouthAfrica, which was created by myself and involved hacking over 50 SouthAfrican websites, these were the main sites I targeted, and it shows Usernames, passwords, emails, Postal address's,databases,SQL Dumps and so on.

The third link of Tonights raids:
Contained 10,000+ SQL-i Vulnerable website links. Every one of these links was in-fact vulnerable at some point in time. So if a couple don't work now, then they've patched it.
These are just a taste of what's to come.

First  link:
http://www.mediafire.com/?elm9kvaend2tk8y   <--- Tax records

Second link:
http://www.mediafire.com/?nk69n6c5ufek8yk <--- #opSouthAfrica

Third  link:

http://www.mediafire.com/?ryx7apfx6ohca7b   <--- 10k+ Vulnerable Sites
 

Fore more info Click Here


SHARE OUR NEWS DIRECTLY ON SOCIAL NETWORKS:-

Leaked FBI Documents is Calling "Anonymous is A National Security Threat"


According to a PDF containing what purports to be a leaked psychological assessment of the leaders of LulzSec and Anonymous by the FBI's Behavioral Science Unit (which also profiles serial killers), Anonymous is not only not a collection of individuals, it's a coherent group that poses a threat to national security.
Neither the FBI nor Dept. of Homeland Security have commented on the "leak," which may be a fake according to the TechHerald, but seems to reflect accurately the thinking behind a series of DHS warning bulletins and crackdowns that have resulted in 75 raids and 16 arrests of Anonymous members just this year.
Anons themselves refer to the group as a rough, almost coincidental collective of individuals that occasionally cooperate on projects to protest specific things. There are approximately eight vortices of special interest within the collective, according to interviews, postings and counter-arguments posted by various Anonymi in response to invective by those it attacked.
Attacks are the work of small groups of interested individuals who, on their own initiative and using public argument as their weapon, gather like-minded Anonymi to protest governmental outrages or attack injustice in whatever form they find it, according to de facto leaders in the non-existent but vocal #OPpublicrelations.
In March, for example, members of Anonymous and 4Chan debated, in the finest traditions of American Democracy and citizen activism, whether to attack and defeat the Internet scourge that is Rebecca Black – the annoying but harmless pop "singer" whose made herself famous with a mom-and-dad-funded music video on YouTube that repeated the same lyrics so often it became apparent those might be the only words she knows.(Other, less world-shaking Anonymous projects resulted in significant attacks against the embattled governments of Egypt and Syria, the exposure of government atrocities in Bolivia, civil protest against censorship on the Bay Area Rapid Transit System, attacks on Visa, Mastercard and Paypal in support of whistleblower site WikiLeaks and a long-simmering, high-profile protest against unrestricted greed, corrosive dishonesty of Wall Street and the and economic destruction from which the rest of the country suffers while financiers continues to prosper.)
The FBI has analyzed various instant messages, forum postings, emails, Twitter posts and other documentation and decided Anonymous behaves more like a coherent organization led by a small number of powerful and focused activists, not a politically involved group of individuals using the Anonymous banner as gathering point.
  • "The Anonymous ‘collective’ has risen from an amorphous group of individuals on the Internet to the current state of a potential threat to national security. Due to the nature of Anonymous, they believe that they are a leaderless collective. However, it has been shown that there is a defined leadership group," the document reads.

  • "A thorough assessment of each UNSUB’s online activities, speech patterns, and general writings was collected by the FBI. Each UNSUB was individually assessed by members of the SBU (sic) and a psychological profile created from these datasets."

  • Most of the members of Anonymous are under 30, but the bulk of its leadership are not teenage hacker/script-kids as many portray themselves, according to the FBI.

  • "It is likely" that Sabu, one of the more vocal spokestrolls for the LulzSec mini-collective of Anonymous, "works in the information security sector and has been doing so since the early days of the internet and hacking activities. His use of net speak is interspersed with proper American English diction and grammar that implies he is an American citizen and has been educated,” the FBI notes said.

BS, quoth the Anon:

"Anonymous is not a group, it does not have leaders, people can do ANYTHING under the flag of their country," according to one member in an email interview with the AP. "Anything can be a threat to National Security, really," the member said in an email interview. "Any hacker group can be."
If the document is real, it ends on a disturbingly dangerous and presumptive conclusion: that attacks and protests by Anonymous will eventually lead to the death of members of Anonymous, law enforcement or the public that will drive many supporters away from Anonymous.
Until then, Anonymous, whether collectively or individually, may be unstoppable in practical terms.

The overall assessment for the movement however is the following:

1. The movement is out of control and there seems to be no real coherent motivation
2. The leaders have begun to hide themselves a bit more due to arrests that have been made
3. Their reliance on technology will eventually be their downfall
4. Their interpersonal relationships are weak points, as such they should be leveraged
5. Their increasing attacks on infrastructure will eventually lead to serious results that could in fact lead to deaths

-News Source (IT World)


SHARE OUR NEWS DIRECTLY ON SOCIAL NETWORKS:-

Related Posts Plugin for WordPress, Blogger...