Password Manager LastPass Got Breached Hard
On Monday password manager service LastPass admitted it had been the target of a hack that accessed its users’ email addresses, encrypted master passwords, and the reminder words and phrases that the service asks users to create for those master passwords.
“We are confident that our encryption measures are sufficient to protect the vast majority of users,” LastPass CEO Joe Siegrist wrote in a note to customers. “Nonetheless, we are taking additional measures to ensure that your data remains secure, and users will be notified via email.”
Officials: Second hack exposed military and intel data
Hackers linked to China have gained access to the sensitive background information submitted by intelligence and military personnel for security clearances, U.S. officials said Friday, describing a cyberbreach of federal records dramatically worse than first acknowledged.
The forms authorities believed may have been stolen en masse, known as Standard Form 86, require applicants to fill out deeply personal information about mental illnesses, drug and alcohol use, past arrests and bankruptcies. They also require the listing of contacts and relatives, potentially exposing any foreign relatives of U.S. intelligence employees to coercion. Both the applicant's Social Security number and that of his or her cohabitant is required.
Report: Hack of government employee records discovered by product demo
As officials of the Obama administration announced that millions of sensitive records associated with current and past federal employees and contractors had been exposed by a long-running infiltration of the networks and systems of the Office of Personnel Management on June 4, they claimed the breach had been found during a government effort to correct problems with OPM's security.
According to a Wall Street Journal report, the breach was indeed discovered in April. But according to sources who spoke to the WSJ's Damian Paletta and Siobhan Hughes, it was in fact discovered during a sales demonstration of a network forensics software package.
German parliament cyber-attack still 'live'
It involved attackers using malicious programs to infect many of the 20,000 machines used by politicians, support staff and civil servants that sit on the Parlakom network.
German newspaper Der Spiegel quoted a parliamentary source who said the malware was still "active" and stealing data from infected machines.
One report suggested that the federal office for computer security (BSI) had said that cleaning up the infection could cost millions of euros and involve replacing all the computers.
Belgium Arrests Two in Probe Over Returning Syria Fighter
Belgian arrested two suspects and issued arrest warrants against three others following anti-terror raids Monday.
Investigators said earlier they had detained 16 people in the anti-terror raids after working with U.S. authorities to monitor suspects’ communications on WhatsApp Inc.’s messaging service.
Virty servers' independence promise has been betrayed
One of the killer selling points of virtualisation is that when a physical cluster node needed fixing, upgrading or taking out of service it is a trivial matter to just migrate the hosts virtual machines onto another cluster node.
In big business, where everything is change controlled to the smallest degree, changes that require host outages can cost several hundreds of pounds by the time all the work is completed. Failing a piece of work because there was a faux cluster node on the host is seen as a big issue.
After FBI domain expires, seized Megaupload.com serves up porn
Based on evidence collected by Ars, it appears someone at the FBI's Cyber Division failed to renew the domain registration for CIRFU.NET, the domain which in turn hosted Web and name servers used to redirect traffic headed to seized domains.
It was over a week before anyone at the FBI contacted GoDaddy. Early on May 24, Gerlach said, "We got a notice of an ongoing criminal investigation regarding malware distribution, which lead to a Terms of Service violation and domain suspension."
Earl Grey was, to say the least, not a very happy GoDaddy customer when he found out about the domain suspension—especially as the suspension also revoked his Domains By Proxy coverage and revealed his registration information through the Whois service.
AdBlock Plus secures another court victory in Germany
German broadcasters RTL and ProSiebenSat.1 had argued that browser plug-in was anti-competitive and threatened their ability to offer users content for "free".
A spokeswoman for RTL responded: "We are weighing a possible course of action against the ruling and assessing the prospects of an appeal."
Last month Eyeo successfully defended itself against similar claims by two other German publishers - Die Zeit and Handelsblatt - at a court in Hamburg.
Moose – the router worm with an appetite for social networks
ESET researchers have issued a technical paper today, analysing a new worm that is infecting routers in order to commit social networking fraud, hijacking victims’ internet connections in order to “like” posts and pages, “view” videos and “follow” other accounts.
The sad truth is that there are many individuals and companies out there who are keen to manipulate their social media standing, and have no qualms about hiring third-parties who claim to have methods to bump up the number of views of a corporate video, boost the followers on a Twitter feed or get you more Facebook fans.
HTTPS-crippling attack threatens tens of thousands of Web and mail servers
The weakness is the result of export restrictions the US government mandated in the 1990s on US developers who wanted their software to be used abroad. The regime was established by the Clinton administration so the FBI and other agencies could break the encryption used by foreign entities.
"Logjam shows us once again why it's a terrible idea to deliberately weaken cryptography, as the FBI and some in law enforcement are now calling for," J. Alex Halderman, one of the scientists behind the research, wrote in an e-mail to Ars. "That's exactly what the US did in the 1990s with crypto export restrictions, and today that backdoor is wide open, threatening the security of a large part of the Web."