Някои "христоматийни", но много важни истини за кибер шпионажа

Protecting data against cyber-espionage

When you conduct your risk analysis, think about how your organization might be targeted by state actors

October 19, 2015

Healthcare IT News

Rick Kam - president and co-founder of ID Experts.

The days of James Bond and his world-saving exploits are over. In today's reality, nation-states and their criminal partners can disrupt commerce and defenses in the free world from the safety and comfort of their computer desks. Their prime targets are not top-secret space weapons but everyday businesses and business systems, and healthcare organizations are just as vulnerable as any other industry. Hospitals, smaller providers, health plans, and business associates can all become targets of cyber-espionage, so it is up to every business decision-maker to understand the threats.

Cloak and ledger
Cyber-espionage against businesses is safer, easier and often more effective than targeting governments. Industrialized nations compete for world dominance in economic markets, so cyber-espionage is being used against businesses to gain competitive advantage.

Of special concern is the fact that cyber-warriors target small and mid-size businesses because they tend to have weaker defenses than critical government or military organizations. Business systems now connect with partners of all sizes, so a mid-size or small business network may provide the opening that offers cyber-attackers a path into a business partner's networks, either immediately or in the future. According to Gary Loveland, a principal in PricewaterhouseCoopers' Consumer, Industrial Products and Services group, "Today's hackers are farsighted and more tenacious now when it comes to midsize and smaller companies. They might hack a high-tech startup, thinking, 'When you get bought by a big company, the first thing you'll do is connect to their networks, and then, bam! I'm in.' You don't want your company to be that conduit."

Smaller organizations can also hold personal data on customers or employees that could be used to coerce individuals into revealing security codes and other sensitive information. For example, if medical records revealed an official in a key position had an alcohol problem or financial records revealed a gambling problem, that person might be coerced into revealing industrial plans, network passwords, or other sensitive information.

Everyday hacks
Part of the beauty of cyber-espionage, from the standpoint of nation-states, is that it uses the same methods as any other kind of cyber-attack--skills, tools, and techniques that are abundantly available and hard to distinguish from any garden-variety cyber-criminal. However, cyber-espionage attacks are more likely to be multi-stage as opposed to attacks by cyber-criminals seeking saleable information such as credit card numbers or medical records.  

For example, an attack might start with spear phishing, an e-mail spoofing fraud to gain user passwords or other confidential data, or a watering hole attack, hijacking of a legitimate community of interest site, to introduce malware to the computer or device of employees or customers. From there, the attackers will go on to quietly explore the compromised networks, looking for additional vulnerabilities and back doors into the networks of business partners and data that may be useful for competition or coercion. While the common cyber-criminal may "smash and grab" for a quick payoff, and hacktivists may quickly publicize stolen data to embarrass the target, cyber-spies play the long game.

Four defenses against cyber-espionage
How can an organization defend against the growing threat of cyber-espionage? The good news is that the tactics of cyber-warfare are the same as any other kind of cyber-crime, even if the ends are different, so defensive best practices are also the same. The key element is awareness. Consider these strategies:

When you conduct your risk analysis, think about how your organization might be targeted by state actors. Consider which employees, customers, or business partners might have access to particularly sensitive data and which might be most vulnerable to coercion, and capture that information in your risk profile. (For example, staff members who hold network passwords should always be considered as potential targets.)

Identify the data that might be targeted for cyber-espionage and figure that into your spending priorities for security programs.

Because most cyber-espionage attacks are multi-stage, you need awareness programs and training programs to help employees and possibly customers avoid becoming victims of social engineering, and you should keep them informed about new social engineering scams. (Part 2 of this series, listed some good resources for news on security threats.)

Figure cyber-warfare into your incident response plans, as you would for any other breach risk. What partners and agencies would need to be brought into an investigation, and which should notified right away? How can you protect breached individuals against coercion? How can you mitigate damage from stolen information? These can be tough questions, and the answers won't always be obvious, but the threats are real, and national security and your organization's survival may rest on them.

Една от "къщичките" на кибер престъпниците - The Dark Web

A tour of the Dark Web: home of the cyber-criminal

Every information security professional who touches healthcare data needs to become intimately familiar with

October 5, 2015

Healthcare IT News

Rick Kam - president and co-founder of ID Experts.

In its 2015 U.S. State of Cybercrime Survey, Pricewaterhouse Coopers calls 2015 "a watershed year for cybercrime." This conclusion is echoed in many studies, which have found that cybercrime has now outpaced insider theft, mishandling of records, and other sources of data breach in healthcare. The PwC study showed that hackers, hacktivists, organized crime, and foreign nation-states accounted for 61 percent of data security threats in 2014.

Every information security, risk, privacy, and compliance professional who touches healthcare data needs to become intimately familiar with emerging threats and threat actors. In the first part of this three-part series on cyber-crime, I wrote about how cyber-criminals are monetizing stolen healthcare data. In this article, I'll look at the Dark Web, the information superhighway of illicit commerce.

What is the Dark Web?
Most people navigate the World Wide Web via well-known search engines such as Google or Bing. Underneath the publicly accessible web, however, is the "Deep Web," the part of the web that is not indexed by common search engines. The Deep Web hosts the "Dark Web," a series of networks called "darknets" that overlay the public Internet but require specific software or authorization to access.

Darknets were created to allow users to operate anonymously, so it's no surprise that a lot of the Dark Web is devoted to criminal activities. In fact, the Dark Web hosts a worldwide marketplace of illicit goods and services, most of which are paid for in Bitcoin, the preferred currency of the black market. A recent study by Dr. Gareth Owen, "Tor: Hidden Services and Deanonymisation," found that the most common requested information on one of the top darknets, Tor (an acronym for "The Onion Router"), is child pornography, followed by black markets for drugs, stolen information, weapons, counterfeit currency, and more.

A Dark Web lexicon
If you read Deepdotweb, the Dark Web's equivalent of the New York Times and Wall Street Journal, rolled into one, you quickly realize that the Dark Web has a language of its own. Here are just a few of the Dark Web practices that could be targeting your business right now:

·         Carding schemes are whole programs for monetizing stolen credit card information. Dark Web users can join carding forums where they learn how to steal card numbers and clone cards, how to cash out the card's credit limit, how to sell card numbers, how to get personal information to fully exploit a card, and how to set up as a vendor of stolen card information.

·         Doxxing is stealing and publishing private or personal information about someone, usually with malicious intent. The information is often obtained through social media or social engineering, and the tactic is often used by "hacktivists" to shame public figures or companies, although the threat of exposing information can also be used for coercion or extortion.

·         Dumping is the practice of posting large sets of private information on the Dark Web. For example, after the recent Office of Personnel Management breach, databases containing personal information and email addresses of thousands of federal employees were dumped. Data dumps may be put up for sale or exposed publicly to embarrass or damage the organization that was breached.

Darknet vendors use exit scams to get out of a black market business, for example, if law enforcement gets too close, while still pocketing money from customers. Sellers simply continue to advertise and accept payment while not delivering product. When the online customer reviews turn negative, the vendor simply posts that he or she has been scamming and has skipped town, so sorry, better luck next time.

Stay informed and see them coming
The first step to defend against all these threats is to know what they are and where they're coming from. For example, social engineering attacks are often the first step in wholesale attacks on an organization's internal systems. By tracking new social engineering scams, your information security/privacy team can warn employees and patients about phishing attacks ahead of time and help keep them from revealing information that could lead to the introduction of malware and massive breaches.

Some good sources are Brian Krebs' excellent column on cyber-security, the Norse Dark Matters newsletter, andDeepDotWeb for the buzz in the cyber-crime community. My next article in this series will be about one of the newest and most surprising cyber-threats against businesses: the methods and motivations behind cyber-espionage and cyber-attacks by nation-states.

Нови разкрития в областта на криптографията !

How is NSA breaking so much crypto?

OCTOBER 14, 2015 BY ALEX HALDERMAN AND NADIA HENINGER 89 COMMENTS

There have been rumors for years that the NSA can decrypt a significant fraction of encrypted Internet traffic. In 2012, James Bamford published an article quoting anonymous former NSA officials stating that the agency had achieved a “computing breakthrough” that gave them “the ability to crack current public encryption.” The Snowden documents also hint at some extraordinary capabilities: they show that NSA has built extensive infrastructure to intercept and decrypt VPN traffic and suggest that the agency can decrypt at least some HTTPS and SSH connections on demand.

However, the documents do not explain how these breakthroughs work, and speculation about possible backdoors or broken algorithms has been rampant in the technical community. Yesterday at ACM CCS, one of the leading security research venues, we and twelve coauthors presented a paper that we think solves this technical mystery.

The key is, somewhat ironically, Diffie-Hellman key exchange, an algorithm that we and many others have advocated as a defense against mass surveillance. Diffie-Hellman is a cornerstone of modern cryptography used for VPNs, HTTPS websites, email, and many other protocols. Our paper shows that, through a confluence of number theory and bad implementation choices, many real-world users of Diffie-Hellman are likely vulnerable to state-level attackers.

For the nerds in the audience, here’s what’s wrong: If a client and server are speaking Diffie-Hellman, they first need to agree on a large prime number with a particular form. There seemed to be no reason why everyone couldn’t just use the same prime, and, in fact, many applications tend to use standardized or hard-coded primes. But there was a very important detail that got lost in translation between the mathematicians and the practitioners: an adversary can perform a single enormous computation to “crack” a particular prime, then easily break any individual connection that uses that prime.

How enormous a computation, you ask? Possibly a technical feat on a scale (relative to the state of computing at the time) not seen since the Enigma cryptanalysis during World War II. Even estimating the difficulty is tricky, due to the complexity of the algorithm involved, but our paper gives some conservative estimates. For the most common strength of Diffie-Hellman (1024 bits), it would cost a few hundred million dollars to build a machine, based on special purpose hardware, that would be able to crack one Diffie-Hellman prime every year.

Would this be worth it for an intelligence agency? Since a handful of primes are so widely reused, the payoff, in terms of connections they could decrypt, would be enormous. Breaking a single, common 1024-bit prime would allow NSA to passively decrypt connections to two-thirds of VPNs and a quarter of all SSH servers globally. Breaking a second 1024-bit prime would allow passive eavesdropping on connections to nearly 20% of the top million HTTPS websites. In other words, a one-time investment in massive computation would make it possible to eavesdrop on trillions of encrypted connections.

NSA could afford such an investment. The 2013 “black budget” request, leaked as part of the Snowden cache, states that NSA has prioritized “investing in groundbreaking cryptanalytic capabilities to defeat adversarial cryptography and exploit internet traffic.” It shows that the agency’s budget is on the order of $10 billion a year, with over $1 billion dedicated to computer network exploitation, and several subprograms in the hundreds of millions a year.

Based on the evidence we have, we can’t prove for certain that NSA is doing this. However, our proposed Diffie-Hellman break fits the known technical details about their large-scale decryption capabilities better than any competing explanation. For instance, the Snowden documents show that NSA’s VPN decryption infrastructure involves intercepting encrypted connections and passing certain data to supercomputers, which return the key. The design of the system goes to great lengths to collect particular data that would be necessary for an attack on Diffie-Hellman but not for alternative explanations, like a break in AES or other symmetric crypto. While the documents make it clear that NSA uses other attack techniques, like software and hardware “implants,” to break crypto on specific targets, these don’t explain the ability to passively eavesdrop on VPN traffic at a large scale.

Since weak use of Diffie-Hellman is widespread in standards and implementations, it will be many years before the problems go away, even given existing security recommendations and our new findings. In the meantime, other large governments potentially can implement similar attacks, if they haven’t already.

Our findings illuminate the tension between NSA’s two missions, gathering intelligence and defending U.S. computer security. If our hypothesis is correct, the agency has been vigorously exploiting weak Diffie-Hellman, while taking only small steps to help fix the problem. On the defensive side, NSA has recommended that implementors should transition to elliptic curve cryptography, which isn’t known to suffer from this loophole, but such recommendations tend to go unheeded absent explicit justifications or demonstrations. This problem is compounded because the security community is hesitant to take NSA recommendations at face value, following apparent efforts to backdoor cryptographic standards.

This state of affairs puts everyone’s security at risk. Vulnerability on this scale is indiscriminate—it impacts everybody’s security, including American citizens and companies—but we hope that a clearer technical understanding of the cryptanalytic machinery behind government surveillance will be an important step towards better security for everyone.

For more details, see our research paper: Imperfect Forward Secrecy: How Diffie-Hellman Fails in Practice. (Update:We just received the Best Paper Award at CCS 2015!)

J. Alex Halderman is an associate professor of Computer Science and Engineering at the University of Michigan and director of Michigan’s Center for Computer Security and Society.

Nadia Heninger is an assistant professor of Computer and Information Science at the University of Pennsylvania.

Как се "осребряват" откраднати, персонални медицински данни,

How cyber criminals use the Dark Web to monetize stolen healthcare data ?

Criminals have become incredibly adept at monetizing stolen identities on a massive scale

September 15, 2015
Healthcare IT News
Rick Kam - president and co-founder of ID Experts.


According to Paul Kocher, one of the leading U.S. cryptography experts, there has been a 10,000-fold increase in the number of new digital security threats in the last twelve years. So it's no real surprise there have been a lot more data breaches in the news lately, particularly in healthcare. In fact, criminal attacks are now the leading cause of healthcare data breaches, according to the Fifth Annual Benchmark Study on Privacy & Security of Healthcare Data by Ponemon Institute.

If you're concerned with data security or privacy these days – and who isn't? – you need to understand the fast-changing world of cyber-crime, cyber-terrorism, and cyber-espionage. In this first article of a three-part series, I'll dig into the motivations and methods of cyber-criminals.

Follow the money
How could there be, as Kocher says, a 10,000-fold increase in threats in twelve short years? The answer is simple: money. Criminals have become incredibly adept at monetizing stolen identities on a massive scale.

Two factors have provided the growing conditions for this problem. First, large-scale cyber-crime is a natural consequence of the massive digitization and integration that has been going on since the 1990s. Simply put, there are massive amounts of information connected to or traveling across the Internet. The second factor is the "Dark Web," the web content that exists on so-called darknets, limited-access sites that overlay the public Internet and are often used for illegal or criminal activity. The Dark Web offers cyber-criminals multiple global marketplaces in which to sell stolen personal information. The abilities to steal and easily sell massive amounts of personal information have transformed the economics of information theft.

Best practices in a bad business
One interesting shift over the last decade is that identity fraud is now a multi-tier business. According to Ken Westin, senior security analyst at Tripwire, many people underestimate the complexity of these transactions. For example, credit card numbers are typically sold in bulk to brokers, who then sell the numbers to individual buyers. Top sellers can even give away personal records as free samples so buyers can see the quality of their wares. This chain of distribution lets cyber-thieves concentrate on stealing information without the effort of exploiting it, and it makes it harder for law enforcement to trace the theft back to the source.

Because stolen information has a "shelf life," just like groceries and other perishable goods, buyers have a limited time to exploit it. At some point, the theft will be discovered, either because the business discovers their systems were compromised or because the victim becomes aware the information is being misused. Unfortunately, it's usually the latter, and the damage is done long before a breach is discovered.

There are a number of different schemes for monetizing it in a timely way. Medical identity fraud either takes the form of fraudulent billing by unethical providers or misuse of another person's medical records to obtain care. This kind of fraud may not be discovered for months or years, making stolen medical identities among the most valuable. Bank fraud is also less time-sensitive. If a buyer can get fairly complete bank information, they can clear out accounts before the account holder realizes it, and bank accounts don't have as strong protection as credit cards.

The black market: Where stolen information is commoditized
Cyber-criminals sell stolen information on black markets either individually or in lots, and the price varies depending on how much value the buyer can get from the information. For example, easily obtainable information such as birthdates will go for a few dollars, since it can't be monetized by itself. More valuable information such as a medical record can sell for $50. Business Insider reports that ready-to-use counterfeit Social Security cards can sell for $250 to $400, and bank account information sells for $1,000 and up, averaging 6 percent of the money in the account.

So how much can cyber-criminals make? In its 2014 report, the Center for Strategic and International Studies estimated that cyber-crime extracts 15 to 20 percent of the $2 to $3 trillion dollars generated annually by the Internet economy. That's between $300 and $600 billion a year. Clearly, cyber-crime is paying off big-time.

A strategic defense
In Nicole Perlroth's New York Times article, Scott Borg, the head of the non-profit United States Cyber Consequences Unit, sums up the state of cyber-security: "People are still dealing with this problem in a technical way, not a strategic way. People are not thinking about who would attack us, what their motives would be, what they would try to do. The focus on the technology is allowing these people to be blindsided." The last few years have certainly proven that cyber-criminals can outrun technology, and it's also not financially feasible to defend your data on all fronts. To mount a strategic defense, you have to understand where the next attacks are likely to be coming from.

REMOTE TRAINING 

FOR 

INFORMATION SECURITY MANAGEMENT SYSTEM (ISO 27001),

SERVICE (IT) MANAGEMENT SYSTEM (ISO 20000-1)

AND

COUNTERACTION TO THE ‘INSIDERS’ MALICIOUS ACTIVITIES

LIST OF COURSES

1. Approach and methodology for building Information Security Management System (ISMS) in accordance with the requirements of ISO 27001: 2013 and ISO 27002: 2013 recommendations.

The aim of the course is to prepare learners to self-build, maintain and develop ISMS, compliant with the requirements of ISO 27001: 2013 and ISO 27002: 2013 recommendations.

2. Approach and methodology for development and maintenance of Service (IT) Management System (SMS) in accordance with the requirements of ISO 20000-1: 2011 and the recommendations of ISO 20000-2: 2012.

Course aims to prepare students for self-development, implementation and maintenance of SMS, in accordance with the requirements / recommendations of international standards, as follow:
- ISO 20000-1: 2011 - Information technology - Service management - A Unit 1: Requirements for SMS
- ISO 20000-2: 2012 - Information technology. Service management - Part 2: Code of Good Practices for Service Management

3. Counteraction to the “INSIDER” malicious activities.

The course is designed for professionals in the field of information security – including high and middle level managers. The course addresses the main practices against malicious "insiders", creating risks to the information security and business of the organization.
For the purpose of this training course in malicious "insiders" or malicious "insider" means a current or former employee, contractor or business partner who meets the following criteria:
- Has or had authorized access to the network (s) systems and data / information of the organization;
- Deliberately or intentionally exceed authorized access, using this in a way, that violates the confidentiality, integrity and / or availability / accessibility of data / information or information systems of the organization as a whole.

4. Methodology for the development of the documentary part of ISMS in accordance with the requirements of ISO 27001: 2013

The training course is designed to prepare trainees to independently develop, implement and maintain the documentary part of the ISMS in accordance with the requirements of ISO 27001: 2013 and ISO 27002: 2013 recommendations.
During the course discusses the construction sequence of the documentary part of the ISMS, tools for its establishment and a large amount of documents of different types - policies, procedures, instructions, procedures, plans and others.
The methodology is applied repeatedly from organizations that have developed and certified ISMS for the degree of compliance with the requirements of ISO 27001.

5. Methodology for the development of the documentary part of the SMS in accordance with the requirements of ISO 20000-1: 2011

The training course is designed to prepare trainees to independently develop, implement and maintain a documentary of SMS in accordance with the requirements of ISO 20000-1: 2011 and the recommendations of ISO 20000-2: 2012.
During the course discusses the construction sequence of the documentary part of SMS, large amount of documents of different types - policies, procedures, plans and others.
The methodology takes into account the presence or absence of built in organization Quality Management Systems (QMS – ISO 9001) and / or ISMS (ISO 27001) in determining the scope of the documentary of the SMS.


For questions and additional information:

infosecservicebg@gmail.com
+359 886 655 315 - Plamen Kamenov
http://infosecservicebg.wix.com/study-security

Електронно обучение по Системи за управление на информационната сигурност (ISO 27001) и услугите (ISO 20000-1)

СПИСЪК 
НА ОСНОВНИТЕ КУРСОВЕ ЗА ЕЛЕКТРОННО ОБУЧЕНИЕ 
ПО СИСТЕМИ ЗА УПРАВЛЕНИЕ НА 
ИНФОРМАЦИОННАТА СИГУРНОСТ И УСЛУГИТЕ

1. Подход и методология за изграждане на Система за управление на информационната сигурност (СУИС) в съответствие с изискванията на ISO 27001:2013 и препоръките на ISO 27002:2013.

Целта на курса е да подготви обучаемите, самостоятелно да изградят, поддържат и развиват Система за управление на информационната сигурност (СУИС), отговаряща на изискванията на ISO 27001:2013 и препоръките на ISO 27002:2013.

2.Подход за изграждане и поддръжка на Система за управление на услугите (СУУ) в съответствие с изискванията на ISO 20000-1:2011 и препоръките на ISO 20000-2;2012.

Курса има за цел да подготви обучаемите за самостоятелно разработване, внедряване и поддръжка на Система за управление на услугите (СУУ), отговаряща на изискванията / препоръките на международните стандарти:
- ISO 20000-1:2011 - Информационни технологии — Управление на услуги —Част 1: Изисквания към системите за управление на услуги
- ISO 20000-2:2012 - Информационни технологии. Управление на услуги - Част 2: Кодекс за добра практика при управление на услуги

3. Мерки за противодействие на заплахите към информационната сигурност, предизвикани от злонамерени, „вътрешни хора”.

Курса е предназначен за специалисти в областта на информационната сигурност и мениджъри на средно управленско ниво. В курса са разгледани основните практики за противодействие на злонамерени "вътрешни хора", създаващи рискове за информационната сигурност и бизнеса на съответната организация.
За целите на този Курс за обучение, под злонамерени „вътрешни хора” или злонамерен „вътрешен човек” се разбира настоящ или бивш служител, контрактор или бизнес партньор, който отговаря на следните основни критерии:
- има или е имал упълномощен достъп до мрежа (и), системи или данни / информация на организацията;
- умишлено превишава или умишлено използва този упълномощен достъп по начин, който нарушава конфиденциалността, интегритета и / или наличността / достъпността на данни / информация или на информационните системи на организацията, като цяло.

4. Методология за разработване на документалната част на Система за управление на информационната сигурност (СУИС), в съответствие с изискванията на ISO 27001:2013

Курса за обучение е предназначен да подготви обучаемите, самостоятелно да разработят, внедрят и поддържат документалната част на СУИС,  в съответствие с изискванията на ISO 27001:2013 и препоръките на ISO 27002:2013.
По време на курса се разглеждат последователността за изграждане на документалната част на СУИС, инструментариума за нейното създаване и голямо количество документи от различен тип - политики, процедури, инструкции, методики, планове и др.
Методологията е прилагана многократно от организации, които са изградили и сертифицирали СУИС, за степен на съответствие с изискванията на ISO 27001.

5. Методология за разработване на документалната част на Система за управление на услугите (СУУ), в съответствие с изискванията на ISO 20000-1:2011

Курса за обучение е предназначен да подготви обучаемите,  самостоятелно да разработят, внедрят и поддържат документалната част на СУУ, в съответствие с изискванията на ISO 20000-1:2011 и препоръките на ISO 20000-2:2012.
По време на курса се разглеждат последователността за изграждане на документалната част на СУУ  и голямо количество документи от различен тип - политики, процедури, планове и др.
Методологията отчита наличието или липсата на изградени в организацията системи за управление на качеството (СУК) и/или на информационната сигурност (СУИС) при определяне обхвата на документалната част на СУУ.

Контакти за въпроси и допълнителна информация:

infosecservicebg@gmail.com

+359 886 655 315 – Пламен Каменов

http://infosecservicebg.wix.com/study-security

Седем "брутални" кибер атаки

Top 7 brutal cyber attacks

Monday, September 07, 2015
The Hacker News
Author: Khyati Jain

Part 1

If you believe that your organization is not at real risk of cyber attack, then you are absolutely wrong.

Incidents of massive data breaches, advanced cyber attacks coming from China, groups like Syrian Electronic Army, Hacking Point of Sale machines at retailers such as Target have splashed across the news in the last one year.

Whether a Government Agency or Private Company, Small or a Large Tech Company....

...It’s no secret that No one is Immune to Cyber Attacks.

This article is the first in a two-part series from The Hacker News, listing first four out of  Top 7 Brutal Cyber Attacks.

And here we go...

#1 "Hacking Team" Data Breach

Hacking Team, the controversial spyware company, recently been hacked by some unidentified hackers that exposed over 400 gigabytes of its internal sensitive data on the Internet.

Milan (Italy) based IT firm ‘Hacking Team’ sells intrusion and surveillance software solutions to Governments and Law Enforcement agencies worldwide.

Hacking Team is infamous for its commercial surveillance tool named as Remote Control System (RCS), which is capable of spying activities and remotely accessing target system’s microphone and camera.

However, sometimes even Hackers get Hacked! So same happened with Hacking Team when hackers not only defaced Hacking Team’s own Twitter account but also leaked:
• Executive Emails
• Source codes for Hacking and Spyware Tools
• Zero-day exploits, including for Flash, Internet Explorer
• Government client list with date of purchase and amount paid
…Marking the attack as one of the biggest cyber attacks on any Company.

#2 Ashley Madison Data Breach

TIP: No website can guarantee privacy of your identity, Credit card details, personal photos or any other information. [Read more]

Two months ago, Toronto-based Ashley Madison website, popular as an online Married Dating portal for extramarital affairs with the tagline "Life is Short. Have an Affair," was hacked by ‘The Impact Team’.

Hackers allegedly gained access to millions of its customers information database and posted 10GB of personal data for its tens of Millions of customers, including their names and email addresses.

Frequently followed by another leak, where hackers released another 20GB of company's internal data, including personal e-mails from the CEO of Ashley Madison parent company Avid Life, Noel Biderman, along with the source code for its website and mobile apps.

The breach came just two months after an attack on another scandalous site, Adult Friend Finder where again millions of people’s very personal data were left exposed on the Internet.

The Ashley Madison and Adult Friend Finder hacking cases raise serious questions about what these dating websites are doing to ensure the security of their users' personal information.

#3 The Sony Pictures Hack

Remember last year when you were able to download and watch unreleased movies of Sony PicturesEntertainment?

Annie, Mr. Turner, Still Alice, To Write Love On Her Arms, and Brad Pitt's "Fury”...

...were leaked online on torrent websites, following a massive cyber attack on Sony Pictures last year by theGuardians of Peace (GOP) hacking group.

The hack wasn’t limited to unreleased movies — the unknown hackers leaked about 200 gigabytes of confidential data belonging to Sony Pictures from movie scripts to sensitive employees data, celebrity's' phone numbers and their travel aliases, making it the most severe hack in the History.

The massive cyber attack on the company was in response to the release of "The Interview" — a controversial North Korean-baiting film, where hackers threatened 9/11 Type attack at Theaters showing this movie.

As a result, Sony had to shut down its services for weeks. However, it struggled to solve the issue by pulling “The Interview” from theaters and eventually putting it up on Netflix.

But, things have not changed much for Sony. This was the second time Sony was targeted, and the intensity of the attack was such that even after taking the best measures, a subsequent amount of the company’s data was leaked to WikiLeaks.

#4 'Fappening' and 'Snappening'

When a surge of Nude Photos of Celebrities were leaked and went viral in August of 2014, the Internet had a meltdown.

Unknown Hacker was able to break into third-party applications connected to services like Facebook, Twitter, Instagram and Apple’s iCloud that led to a major incident known as “The Fappening”.

The Fappening mainly attacked female celebrities and leaked very private photographs of them, includingJennifer Lawrence, Kim Kardashian, Kirsten Dunst, Avril Lavigne and many others.

Within a month of “The Fappening,” another similar incident called “The Snappening” happened that leaked more than 100,000 nude videos and images of the Snapchat users.

In The Fappening, the Naked Pictures were allegedly retrieved due to a “brute force” security flaw in Apple’s iCloud file storage service. However, Apple denied it.

In case of The Snappening, Snapchat’s servers were not breached. Instead, the nude pictures of users were compromised due to third-party apps used to send and receive Snaps.

However, both the incidents marked as the biggest hacks of one of its kind.


Part II 

In Part I of this two-part series from The Hacker News, the First Four list of Top Brutal Cyber Attacks shows that whoever you are, Security can never be perfect.

As attackers employ innovative hacking techniques and zero-day exploits, the demand for increased threat protection grows.

In this article, I have listed another three cyber attacks, as following:

#5 Car Hacking

Driving a car is a network’s game now!

'Everything is hackable,' but is your car also vulnerable to Hackers?

General Motors’ OnStar application and cars like Jeep Cherokee, Cadillac Escalade, Toyota Prius, Dodge Viper, Audi A8 and many more come equipped with more advanced technology features.
These cars are now part of the technology very well known as the “Internet of Things”.

Recently two Security researchers, Chris Valasek and Charlie Miller demonstrated that Jeep Cherokee could be hacked wirelessly over the internet to hijack its steering, brakes, and transmission.

The OnStar application is an inbuilt unit attached to the interior, rearview mirror of the car with features such as remotely unlocking cars and starting the engines.

Similarly, Jeep manufactured Jeep Cherokee’s latest model is the fourth generation car fully equipped with the latest technology advancements.

In the recent incidents, Jeep Cherokee, as well as OnStar's application, were hacked leaving the cars as the slaves of the hackers and prone to accidents.

A security flaw in the car's entertainment system was compromised by two white hat hackers: Charlie Miller and Chris Valasek. The flaw allowed the hackers to inject malware into the system for remote control from miles away.

The hackers were able to turn up the music volume to the maximum and start the windshield wipers remotely while they were ‘10 miles away’.

An outrageous act they did was cutting off the transmission and disconnected the brakes that led the car crash into a ditch.

Reports say that both Jeep Cherokee and Escalade have an inherent security flaw. This is such:

The cars' apps, Bluetooth and telematics connecting the car to a cellular network like OnStar are on the same network as the engine controls, brakes, steerings and tire pressure monitor system.

Miller and Valasek said a car’s networked system could be an easy gateway for the hackers to come in with just the use of their mobile phones and a laptop.

What they need to do is just know the car’s IP address, and they can break into its system through a wireless internet connection.

#6 Data Breach at US Government Office of Personnel Management

United States Office of Personnel Management (US OPM) is an independent agency of the United States that works to recruit, retain and honor a world-class workforce for the American people.

The US OPM became a victim of a cyber attack twice that led to a data breach, compromising personal information of some 21.5 million related to current and former federal workers.

Hackers accessed sensitive data of US government officials that could be used for identity theft and cyber-espionage.

The stolen data included Social Security Numbers, employment history, residency and educational history, criminal and financial history, fingerprints, information about health, personal and business acquaintances.

Some stolen records also include findings from interviews conducted by background investigators that discussed sexual assaults and drug, mental health treatments and alcohol addictions.

Investigations reveal that China-based hackers were behind the data breaches at the Office of Personnel Management (OPM).

#7 Anthem Data Breach

Anthem Insurance Inc., previously known as WellPoint Inc, was a victim of a massive cyber attack in February.

Back in February, Cyber attackers executed a very sophisticated attack to gain unauthorized access to the company’s IT systems that had database of some 80 million people and obtained personal identifiable information (PII) relating to its consumers and employees.

The information accessed included:
• Names,
• Birthdays,
• Social security numbers,
• Email addresses
• Employment information, including income data
The hackers gained access to Anthem's data by stealing the network credentials of at least five of its employees with high-level IT access.

The path may have been "Phishing", in which a fraudulent e-mail could have been used to trick employees into revealing their network ID and password, or into unknowingly downloading software code that gives the hackers long-term access to Anthem’s IT environment.

The company informed millions of its affected customers of the massive data breach that potentially exposed the personal information of its former as well as current customers.

Anthem appointed Mandiant, world’s leading cyber security organization, to evaluate the scenario and provide necessary solutions.


This is just the beginning...

These are just seven; there are many more! And it could reach you too.

The power of the cyberspace and the criminals hovering over it should not be underrated.

Chucking such happenings where your personal data is at risk and being irrational is not the solution rather it is the beginning of activities that will bother you big time in the future.

The cyberspace is like a dope that is capable of psychoactive effects. A proactive thinking and approach will take you ahead of the people on the other end.

Take the time to ponder over the incidents and respond wisely is all we have to say!