Web Security

The security woes for Sony are continuing unabated, and the latest entry in the laundry list of attacks against the company came Thursday when a group of hackers posted a large amount of data that it stole from databases belonging to Sony Pictures and a couple of other subsidiaries.

ED: Gmail Hackers Conned Victims for MonthsDEK: An independent security researcher says that victims of the account takeovers were repeatedly phished over almost a year by attackers believed to be located in China. An independent security researcher who was among the first to investigate a large scale phishing attack aimed at U.S. government and military personnel says that attackers controlled victim accounts for months and repeatedly phished victims during that time. Mila Parkour, a Washington D.C. based independent says that victims of the account takeovers were repeatedly phished over almost a year by attackers believed to be located in China. Victims of the attack included government and military personnel in the U.S. and Asian nations, as well as human rights activists and journalists in China and elsewhere, Google said on Wednesday. According to Parkour, the group or individuals responsible for the attack controlled those accounts for more than a year and repeatedly targeted both the legitimate account owner and his or her associates during that time. The attackers used spoofed e-mail addresses and information harvested from the victims’ accounts to engage in “mini conversations” with their victims, Parkour said. “They used personal knowledge for some phishes…they were very persistent and invasive,” she said. Among other things, the attackers continued to try to harvest online credentials from victims – user names and passwords – using the same technique they used, successfully, to gain access to- and control over the users gmail account. “They would send a new message with the same type (of) password harvesting technique. Sometimes even the same message sometimes (a) new (message),” said Parkour, who described herself as a IT administrator who researches malicious programs as a hobby. Google said in a blog post on Wednesday that it had disrupted the campaign, which it traced to  Jinan, China. The campaign affected hundreds of Gmail users, using malware and phishing attacks to harvest user login credentials. The campaign appears to have been designed to monitor the content of users’ email correspondence.An independent security researcher who was among the first to investigate a large scale phishing attack aimed at U.S. government and military personnel says that attackers controlled victim accounts for months and repeatedly phished victims during that time.

Honda Canada Inc. has announced it was the victim of an attack in March that exposed the records of over 283,000 car owners, potentially putting them at risk of targeted scams.

A high-profile attack on PBS, the U.S. Public Broadcasting System, was made possible by a previously unknown hole in the MoveableType content management software, according to the hacking group that claimed responsibility for the hack.

Google announced its long-awaited mobile payments platform, Google Wallet, in New York City on Thursday. The company claims it will revolutionize commerce. But with stories about massive data breaches and hacks an almost daily occurrence, consumers are most concerned about whether Google Wallet is secure. Here’s what you need to know.

Never ones to be left behind as progress marches on, attackers are beginning to develop more and more tools aimed specifically at exploiting 64-bit machines. The latest entry into the field is an x64 version of the ZeroAccess rootkit, a nasty piece of malware that’s been circulating for some time and has a number of interesting capabilities, including anti-forensics and kernel-level monitoring.

Researchers from ULM University have found a security flaw similar to sidejacking in Google’s Android operating system affecting some 99.7% of the platform’s users. The flaw is in the ClientLogin API, and according to the report, it could allow hackers to steal contact lists, calendar events, and other sensitive data.