Criminals Steal 11,000 Passwords Through Outlook Server

Criminals have by infecting an Outlook mail server of a US company more than 11,000 passwords associated with user names managed to steal. That security Cybereason said in a report (pdf). What company will be concerned was not disclosed.

In the attack, the attackers had a rogue module to the Microsoft Outlook Web Application (OWA) is added, the webmail server where the company made use of. The attackers were able to save all log data through the module. In addition, the module also served as a back door. The company attacked OWA used to give remote users access to Outlook.

According to the security company made this configuration, OWA ideal attack platform, because the server was exposed both internally and externally. Because OWA authentication domain passwords is based, an attacker with access to the OWA server can get your hands on as the domain passwords for the entire organization. The module was found to have more than 11,000 passwords stored. How not know the OWA server initially could become infected Cybereason late.

Free Online Service Scans Inbox Passwords

Many Internet users would save passwords in the inbox of their email account, so that risk once the account is hacked. Security Dash Lane has developed an online service that checks the contents of the inbox on passwords and then displays.

In this way, users can see which online accounts they have all signed up and how many passwords and login data are yet to be found in their inbox. Even if the accounts are no longer used this forms according Dash Lane a risk because they can help logging in to other accounts, especially if the same password is used for multiple accounts.

Dash Lane forgets to mention that an attacker access to the email account has in many cases other accounts registered to take over at the e-mail account by resetting the password, assuming a different password for these accounts than that of the email account is used. Scan Inbox , such as the online service is called, is free to use. Found personal information according Dash Lane only visible to users and not for the company.

Pentagon Hacked Via Password Vulnerability

An unclassified network of the Pentagon earlier this year been hacked because administrators had forgotten to patch a vulnerability. That left the US Secretary of Defense Ashton Carter yesterday during a speech at Stanford University know.

"Earlier this year discovered the sensors that protect unclassified networks of the Ministry of Defence Russian hackers who gained access to one of our networks. They had an old leak found in one of our old networks that were not patched," said Carter. Defense Minister called it alarming that the attackers were able to gain access to an unclassified network, but they were quickly detected on the other side and removed.

"After we had learned valuable information about their tactics, we analyzed their network activities, we have linked to Russia, and then quickly kicked out of the network, in a way that reduces their chance to return," said Carter. The attack, according to Carter a step in the right direction. "My primary goal is to defend our networks, because we are a network central organization, but I'm still worried about what we do not know. Because this was only one attack that we discovered."

Cartner showed further that technologies such as the Internet, have a good and bad side. "The same Internet that Wikipedia allows, let terrorists also see how to build a bomb." According to the Defense Minister's dependence on technology also created vulnerabilities where enemies like to abuse it. As a solution to this problem Cartner pointed to a partnership between government and industry.

Phishing Attack On LinkedIn Users With HTML Attachment

LinkedIn users have become the target of a phishing attack that through html files attempting to steal credentials. The email has the subject "LinkedIn Alert" and argues that there is a mandatory security update is necessary due to unusual activity.

LinkedIn phishing email

For this check is sent an html file. When users open the file, they get to see a copy of the real LinkedIn site. However, the code has been modified so that users via the HTML page to try to log their data forwarding to the attackers, warns anti-virus company Symantec. The IT security advises users to turn on two-factor authentication. Even if the credentials are stolen an attacker can therefore not on the account login.