IT Security Top Headlines

Vardan Kushnir: Russia’s spam king murdered

He is Russia’s most despised Internet figure, sending 25 million spam emails a day and earning 5 figures (US dollars) a month, a fortune by Russia’s standards.

He was into the good, but sleazy life and found dead one morning in his bathroom, skull bashed in.

source

Tags: Vardan+Kushnir, spam, Russia

Posted in personality | No Comments »

ATM machines *are* connected to the internet

Who said ATM machines are not connected to the internet, and hence safe from online theft?

Maybe not all are wired to the net, but at least some are.

Malaysian banks – anybody know their status?

http://www.windowsfordevices.com/news/NS6438545389.html

Tags: ATM+machines, internet, security

Posted in case studies | No Comments »

University server was controlled by hackers for a year

…before anyone found out at Ohio University.

And it’s not a small matter:

• they had likely hundreds of servers, at least 3 were compromised
• at least one of the servers compromised contained Social Security numbers of more than 130,000 people
• the other 2 servers had health records belonging to students treated at the university’s health center stolen, as well as more Social Security numbers.
• penetrated by both US and overseas hackers

The Uni only came to know about it after the FBI discovered someone had remotely taken control of one of the school’s servers. What if they didn’t?

Universities are popular targets for hackers because:

• due to the fact that they store Social Security numbers and other data useful for committing identity thefts
• they don’t take security seriously enough.
• they have to keep information free flowing (maintain delicate balance in flexibility and security), unlike corporations which can issue immediate lockdown

Bill Sams, the school’s CIO said: "We need someone somewhere to come up with a set of best practices for schools."

How hackers managed to get in, according to Sams:

A server supporting the alumni relations department was supposed to be offline. The people responsible for shutting it down thought they had done so. The server continued to be connected to the Internet but didn’t receive security updates. It was the equivalent of leaving a backdoor open for thieves to walk in and seize what they wanted.

The following is a sobering statement for all of us:

"We had a failure of both policies and procedures," Sams said. Asked why, when so many schools were succumbing to computer attacks, Ohio University wasn’t quicker to order a security audit, Sams replied: "Should we have? Yes. Did we? No."

Posted in case studies | No Comments »