These Financial IT Security links are part of a weekly series, Ethical Hacker Roundup, featuring recent information security and cyber security related articles that we’ve read over and thought worth sharing.
These articles were emailed to us, shared on Twitter @pivotpointsec and our Google+ page, and read in RSS subscriptions this week.
Anonymous Leaks Bank of America Data in “Spy Revenge Hack”
Black hat hackers associated with the so-called Anonymous Intelligence Agency just leaked over 14GB of e-mails and other data that they claim was stolen in a systems breach against Bank of America IT contractor TEKsystems. The hackers allege that the bank is “running an online intelligence gathering operation against hactivists.”
The stolen data contains random salary data as well as memos from the contractor to the bank’s security staff, reporting on chat room and social network reconnaissance. It is said to have been filched from a “misconfigured server” in Israel that was “basically open for grabs” such that no security exploits were needed. Bank of America asserts that the data came from a third-party, and that its own systems were not compromised.
Large companies may increasingly be monitoring hacker forums and other social networks for signs that they might come under attack. Financial institutions, in particular, are also increasingly aware of the need to manage third-party risk in line with the growing need to share data with partners for business-critical reasons.
Has “Operation Ababil” Resumed?
Shortly after announcing that they would suspend their DDoS attacks against US banks after the removal of the main copy of a controversial film from YouTube, the hacking group calling itself the al-Qassam cyber fighters (widely believed to be Iranian state-backed) is now claiming responsibility for attacking a number of banks again this week, including CapitalOne, Fifth Third Bank, PNC Bank and Citizens Bank.
The hackers’ alleged motive continues to be the removal of various videos from YouTube. In their latest ultimatum on Pastebin they warn, “…if the insulting films are not removed in the following days the Operation Ababil will be started again next week, March 5, 2013.”
NBC’s Website Hacked to Serve Up Banking Malware
Broadcaster NBC suffered a website hack last week that resulted in its site serving up malware designed to steal bank account details for a period of several hours. Frequently visited sites like these are prime targets for cybercriminals because they provide an opportunity to infect large numbers of systems quickly.
According to security companies, Nbc.com and several related sites were hacked to serve up an iframe, which loads content into a website from another domain. The iframe loaded an exploit kit called Redkit, which checks whether victims are running unpatched software from Oracle and Adobe.
If so, a drive-by download can infect your computer just from viewing the website. The malware steals account credentials for banks that include Bank of America, Chase, Wells Fargo and others.
More financial IT security news from recent days:
- A recent report shows that mobile phishing schemes are increasingly targeting online banking users. In the past year, 75% of mobile phishing URLs were rogue versions of popular banking or financial sites. Among the most targeted institutions are PayPal, Wells Fargo and Bank of America. Mobile users are thought to be more vulnerable because smartphone form factors make it harder to view anti-phishing security elements. Security certification processes are key for all financial services organizations.
- A DDoS attack mounted on Christmas Eve against a regional California bank was meant to distract security staff from an online account takeover against one of its clients. Hackers made off with over $900,000. Computers at the victimized firm’s offices were blocked from accessing the bank during the sophisticated attack.
- Open disclosure and discussion of tactics used in recent major security breaches by various media giants, Facebook, Twitter, Apple – and now Microsoft – is already paying off, as other organizations proactively shore up their defenses. “There is now a grass-roots, band-of-brothers kind of approach with the good guys,” said one analyst. Perhaps the tide is shifting from reluctance about disclosure to greater openness in the hope of helping others.
Financial IT Security
Arguably, beyond the government itself, no industry has a greater impact on the health of our economy than financial services. And nothing has a greater impact on a financial entity than to lose the confidence and trust of its customers. Your Financial IT Security concerns can and should be addressed by an independent and objective Information Assurance firm. Pivot Point Security can help your Financial Organization to know you’re secure and prove you’re compliant. See how we can help.
FEB
A Best-Practices Guide to Information Security Attestation
Risky Business Blog
Techno Blog
In The News
RSS Feed
About the Author:
Marketing at Pivot Point Security