Now this has had some epic fall-out as we all know many people use the same passwords for all their online services, so a whole bunch of Twitter accounts were owned and used for spamming Acai berries – causing Twitter to block/delete these accounts and reset a whole lot of passwords.

Now if you search through the files, there are a whole lot of major corporate domains inside – including some government organizations. This is the fact that is obviously worrying to the FBI and is leading them to carry out an investigation.

The FBI confirmed to PC World that it is investigating the recent intrusion by a group of hackers into Gawker Media’s servers last weekend. The hack exposed more than 200,000 reader e-mail addresses and passwords, and the data is now circulating online as a peer-to-peer torrent file. An FBI representative declined to comment further about the ongoing investigation; however, Gawker Media founder and CEO Nick Denton was scheduled to meet with federal authorities on Monday, according to The New York Post .

On Sunday, an online hacker collective calling itself Gnosis broke into the servers of Gawker Media, which owns a variety of popular online blogs including Deadspin, Fleshbot, Gawker, Gizmodo, Jezebel, io9, Jalopnik, Kotaku and Lifehacker. The hackers obtained the e-mail addresses and passwords for the company’s employees, and the source code for Gawker Media’s content management system. Gnosis hackers also obtained the login credentials for readers who were registered to leave comments on Gawker Media websites.

Gawker Media said most user login information was encrypted, but Gnosis managed to crack the credentials for more than 200,000 accounts. The exposed login information is now part of a data dump contained in a torrent file available on peer-to-peer file sharing networks.

It’s a pretty serious breach as Gawker is one of the major on-line media owners and their network reach is wide. 200,000 accounts with exposed passwords is not a small number and do remember just because people aren’t tech savvy (use weak passwords) it doesn’t mean they don’t hold some high position in some huge MNC.

There’s a big debate going on at Hacker News too about the ethics of e-mailing all the users in the file to notify them their passwords may have been breached. Apparently some people are already doing it, and other are writing scripts to extract the e-mail addresses and notify everyone to ensure no-one gets left behind.

It’s not entirely clear what inspired the attack against Gawker, but a person claiming to represent Gnosis recently told the blog Mediaite that the hacker group broke into the company’s servers because of Gawker’s “outright arrogance.” Previously, it was suggested the Gawker hack was related to the company’s ongoing feud with members of 4chan, an online message board. The Gnosis representative said there was no connection between the hacker group and 4chan.

Despite the potentially criminal acts perpetrated by Gnosis hackers, more high-minded hackers (among software engineers the term hacker refers to someone who is a programming expert) were coming to the defense of Gawker Media users. Readers of Y Combinator’s Hacker News — a news aggregator and discussion thread for technology start-up entrepreneurs and software engineers — banded together to create an automated e-mail program to alert the 200,000 people whose e-mails and passwords were exposed by Gnosis.

You can find a CSV of the file online here where you can check if your details are inside – gawker.csv

There is also another service which will help you hash your username/email and search through the hashes – http://gawkercheck.com/

Source: Network World

You may remember a while back in 2008 it was uncovered (at least publically) that DarkMarket was actually an FBI Sting Operation.

Insiders had apparently known since 2006 that one of the admins was actually an undercover FBI agent. Countless cases have gone to court with the evidence and contacts gathered in the DarkMarket forums. One example would be the Turk named Cagatay Evyapan (nickname Cha0) who got busted.

The latest news is one of the previous admins Renukanth Subramaniam (nickname JiLsi) has pleaded guilty to conspiracy to defraud and admitted his involvement with the site.

A former London pizza delivery man faces a 10-year prison sentence after admitting he helped found the notorious DarkMarket forum for computer crime, several news sites reported.

Renukanth Subramaniam, a 33-year-old Sri Lanka-born man from North London, pleaded guilty at Blackfriars Crown Court in London to conspiracy to defraud and furnishing false information. Authorities say he joined DarkMarket on its first day of operation in late 2005 and helped build it into an online resource for payment card fraud, with a thriving exchange for buying and selling stolen data and its own secure payment system.

DarkMarket operated for three years and had about 2,500 members at its peak. To be accepted, candidates had to provide details of 100 compromised cards to reviewers, who would then verify their validity. Members were required to adhere to a strict code of conduct that forbid foul language and pornography and demanded a kind of honor among thieves.

Subramaniam was one of the earliest members on DarkMarket joining back in 2005 on its first day of operation and becoming an admin soon after that.

He’s facing a maximum sentence of 10 years, I’d imagine the sentence will come out to 2-3 years and with good behaviour he’ll be out of the cushy white-collar prison in 18 months or less.

So much for clamping down on crime eh? I shall reserve further judgment until we actually find out the real sentence.

Subramaniam worked as a site administrator until October 2006, when he was forcibly demoted over allegations of poor security hygiene. He continued as a reviewer until June 2007 and was arrested the following month when he turned himself in to police in Wembley.

DarkMarket was shuttered in September 2008 following the arrest of another site admin who called himself Cha0. According to news reports, the Turkish hacker was known as a supplier of high-quality skimmers for payment card fraud and was eventually accused of kidnapping and torturing a Turkish police informant.

A month later, another DarkMarket admin with the handle Master Splynter was outted as senior cybercrime agent J Keith Mularski of the FBI. The website, it turned out, had been secretly run from an FBI facility in Pittsburgh, Pennsylvania.

Also on Thursday, a second DarkMarket associate pleaded guilty to conspiracy to defraud. John McHugh, 69, of Doncaster, South Yorkshire, was alleged to be an experienced payment card fraudster who went by the online moniker Devilman.

It seems like a lot of the main players in the carding scene are getting shut down, at least those that show a public face.

Of course the underground will always continue to tick on, making money and hiding in the shadows.

So, just be careful where you shop online and always check the ATM for skimming devices!

Source: The Register

After our recent story about the trading of BlackBerries for data theft the issue has emerged again this time more towards the secure disposal of data stored on PC hard disks.

If a company or organisation has a decent data/information security policy in place (Like ISO27001 for example) they should have a secure destruction/disposal policy as part of that.

The current fiasco reminds me of the digital camera sold on eBay containing terrorist information from the MI6!

The recent discovery of a computer on eBay with data on a U.S. missile system underscores the importance of securing data when it is time to retire and dispose of a machine. Enterprises need to have proper plans and oversight in place to protect their information.

When reports that data on a U.S. missile system was found on a computer auctioned on eBay, enterprises were provided another example of what happens when they fail to securely manage data at the end of its life.

In this case, the consequences were nil, as the computer in question was purchased as part of a research project and has been turned over to the FBI. Still, the situation underscores the importance of having policies in place to protect data that extend all the way to the “death” of an organization’s machines.

The kind of information floating around in computers really needs to be kept under a tighter control, how can missile systems data be left on a computer sold on eBay? It just seems ridiculous.

Companies dealing with confidential information generally have data disposal policies in place, why do government organisations dealing with World security not have tight policies regarding disposal of decommissioned hardware?

For sensitive data, it’s best to do it using a disk degausser or seven-way random write algorithm, which some operating systems support either through tools or the command line, noted Forrester analyst Andrew Jaquith. There are also third-party tools that do this as well, he said.

“There’s also the physical option,” he added. “A sledgehammer to the memory card or hard disk is quite effective. It’s also usually faster and arguably more satisfying.”

Another layer of protection can also be found in encryption. Deguassing or physically shredding a drive can be costly, said Seagate’s Gianna DaGiau said. Overwriting a drive also may be incomplete if it doesn’t cover reallocated sectors or is thwarted by drive errors.

“Some corporations have concluded the only way to securely retire drives is to keep them in their control, storing them indefinitely,” said DaGiau, Seagate’s senior manager of enterprise security. “This cannot be considered truly secure, as large numbers of drives in close proximity can easily tempt employees and lead to some drives being lost or stolen.”

A 7 pass overwrite will be good enough in most situations, tools are available to do this for free like DBAN and Eraser so there is really NO excuse not to do it.

Personally if it’s important I’d recommend 7-pass overwrite, then degauss then bang the shit out of it with a baseball bat then burn it up (a blowtorch would be good).

I’d say your data should be pretty secure then, downside is no-one would want it buy it on eBay after you did that.

Source: eWeek

Ah, FBI slammed again, it’s not the first time this has happened.

Remember when a Consultant Breached FBI’s Computers?

It also reminds me of when Homeland Security Scored an F for Internal Security AGAIN

The Government Accountability Office, the federal government’s watchdog agency, Thursday released a report critical of the FBI’s internal network, asserting it lacks security controls adequate to thwart an insider attack.

In the report, titled “Information Security: FBI Needs to Address Weaknesses in Critical Network,” the authors — Gregory Wilshusen, GAO’s director of information security issues, and Chief Technologist Keith Rhodes — said the FBI lacks adequate network security controls.

The FBI “has an incomplete security plan,” the report concluded.

Those who are supposed to protect eh?

The bureau, which had the opportunity to review the GAO’s findings before publication, responded that it wasn’t arguing with some of the technical observations expressed in the GAO report, but disagreed that the FBI is open to unacceptable risk of an insider attack.

In a letter of response to the GAO, Dean Hall, the FBI’s deputy CIO, and Zalmal Azni, the FBI’s CIO, noted, “The FBI concurs with many of the GAO’s technical recommendations and the programmatic recommendation to continue the implementation of information security activities in order to fully establish a comprehensive Information Assurance Program.”

Let’s hope they can make less excuses and just sort it out.

Source: PC World

It turns out yesterday one of the planned speakers at HOPE Number 6 was arrested on Saturday and is being charged by the FBI.

Security Fix obtained a copy of the complaint against “Steven Rambam” the private investigator arrested Saturday at the Hope Number Six hacker conference in New York City. The government document says Rambam is an alias, and that his real name is Steven Rombom, so that is how he’ll be referred to here henceforth.

The complaint, available here as a PDF, charges Rombom with obstruction of justice and with witness tampering, alleging that in April 2006 Rombom impersonated a federal investigator at the request of a client who had hired him to locate a government informant who was central to the client’s money-laundering indictment in 2003.

Seems like it’s not unjust though, he is getting what he deserves. He was taking things a little bit too far.

The government claims that in April Rombom located and visited the California home of the informant’s in-laws, and introduced himself as an FBI agent, flashing what the informant’s mother-in-law described as “a laminated card with an official government gold seal or badge.”

The complaint says “ROMBOM told [the mother-in-law] that he was investigating the [informant], and that her son-in-law was a very bad and dangerous person, and that there were many things about the [informant] that the in-laws probably didn’t know,” such as that the informant had been in jail many times. Rombom also told the mother-in-law that her daughter was in danger because of the informant and that he was afraid for the safety of their daughter, the government says.

1 less speaker for HOPE next time then I guess?

Source: Security Fix

Using standard script kiddy tools a consultant managed to compromise some of the FBI’s computers containing confidential information.

Quite a hack eh?

A government consultant, using computer programs easily found on the Internet, managed to crack the FBI’s classified computer system and gain the passwords of 38,000 employees, including that of FBI Director Robert S. Mueller III.

The break-ins, which occurred four times in 2004, gave the consultant access to records in the Witness Protection Program and details on counterespionage activity, according to documents filed in U.S. District Court in Washington. As a direct result, the bureau said it was forced to temporarily shut down its network and commit thousands of man-hours and millions of dollars to ensure no sensitive information was lost or misused.

The consultant Joseph Thomas Colon was approved (although he does have a somewhat unfortunate surname).

The incident is only the latest in a long string of foul-ups, delays and embarrassments that have plagued the FBI as it tries to update its computer systems to better share tips and information. Its computer technology is frequently identified as one of the key obstacles to the bureau’s attempt to sharpen its focus on intelligence and terrorism.

As usual with the government, no specifics are available..It seems like he got a hold of the SAM file or the shadow file from one of the systems then brute forced the hashes with john the ripper or something similar.

According to Colon’s plea, he entered the system using the identity of an FBI special agent and used two computer hacking programs found on the Internet to get into one of the nation’s most secret databases.

Colon used a program downloaded from the Internet to extract “hashes” — user names, encrypted passwords and other information — from the FBI’s database. Then he used another program to “crack” the passwords by using dictionary-word comparisons, lists of common passwords and character substitutions to figure out the plain-text passwords. Both programs are widely available for free on the Internet.

The new names they are coming up with for this stuff is straight out of the matrix.

The FBI’s Trilogy program cost more than $535 million but failed to produce a usable case-management system for agents because of cost overruns and technical problems, according to the Government Accountability Office.

While Trilogy led to successful hardware upgrades and thousands of new PCs for bureau workers and agents, the final phase — a software system called the Virtual Case File — was abandoned last year. The FBI announced in March that it would spend an additional $425 million in an attempt to finish the job. The new system would be called “Sentinel.”

Hopefully they will do it right this time.

Source: Washington Post

Ah, so finally they got it back, from a street corner of all places.

Let’s hope they shall be a little more careful in the future yah?

The missing laptop and hard drive that contained veterans’ personal information has been found, Veterans Administration Chief Jim Nicholson announced Thursday.

The announcement came at the beginning of a hearing before the House Veterans’ Affairs Committee hearing.

“It was confirmed to me by the deputy attorney general that law enforcement has in their possession the … laptop and hard drive,” Nicholson said in a statement at the hearing. “The serial numbers match.”

Of course the FBI will roll out it’s forensics experts to testify the data has not been accessed, but let’s face it, how hard is it to mount the drive read only and clone it?

Not very right..

Experts were conducting forensic tests on the laptop and hard drive, Nicholson said. It was not immediately clear if the data on the equipment had been copied or compromised, but Nicholson said “there is reason to be optimistic.”

He did not say how the equipment was recovered, on where it’s been during the past two months. The equipment was found Wednesday; Nicholson said he wasn’t aware of any arrests made in connection with the incident.

An FBI spokesman said the laptop computer was recovered “in the area,” but could not provide more specific information. Forensics tests showed “the sensitive files were not accessed,” according to special agent in charge Bill Chase.

We’ll look at the forensics techniques in more depth later.

Source: MSNBC