Major Security Flaws In Hacked Toy Manufacturer VTech

The Chinese manufacturer of educational toys VTech where recently the data of 4.8 million adults and 200,000 children were stolen customer data had not properly secured, according to the Australian security expert Troy Hunt that captured customer data analyzed.

Recently managed to get an attacker access to the customer database and approached Vice Magazine. The journalist of the magazine then contacted Hunt to verify the data. Hunt was sent several files, the largest of which was 1,7GB. This file, called parent.csv, he found the details of 4.8 million people. It was e-mail addresses, names, IP address, mailing address and encrypted passwords. The password proved to be hashed with the MD5 algorithm. It is therefore not directly readable, but MD5 has long been considered unsafe because it is easy to 'crack'. This allows an attacker can still retrieve the password.

VTech had not taken additional measures to protect the passwords, such as the use of "salts" and "stretching". However, it is not the only security problem, says Hunt. As the website does not use SSL, so all communications, including passwords, unencrypted occurs. There is no cryptographic protection of sensitive data, the expert noted. The website appears to provide a SQL statement back at login. The attacker said that he had come in via SQL injection, a problem that has been known since 1998 but is ignored by some companies still. Finally Hunt criticizes the extensive use of Flash on the website of VTech.

The expert also manages the website Have I Been Pwned, where Internet users can check whether they appear in the database of hacked websites. The data of the 4.8 million adults from the database of VTech here are now added. That does not apply to the data of 227 000 children who also were in the stolen data. Hunt has not been added. VTech has confirmed a burglary, but do not know how the attacker managed to get inside.

American Company Claims Chinese Espionage Via SQL Injection

An American security company claims it has detected several cases of Chinese cyber espionage via SQL Injection, but concrete details and evidence are given. Does mention Crowd Strike in the blog posting about the cyber espionage frequent own security product.

About three weeks ago, China and the United States decided not to bother with the steal intellectual property via the internet. According Crowd Strike has seen the number of attacks in which the "high degree of certainty" could state that carried out by Chinese attackers. In which this assumption is based not reported by Crowd Strike.

Many of the attacks directed against companies in the technology and pharmaceutical sectors, Web servers via SQL Injection could be hacked. SQL Injection is a problem that has been known since the end of 1998, but is still found in many websites. Through SQL Injection attackers can communicate with the database behind a website and perform various tasks, which should not actually be executed.

In this way, it is possible, among other in order to steal the contents of databases, for example, user names, email addresses, and whether or not encrypted passwords. In this case the attacker SQL Injection eventually use to install a Webshell. Through this Webshell can be obtained access to the internal network of the victim. Despite the report hopes Crowd Strike which progress could be made, and norms and values ​​can be established countries.

Security Company Claims Dozens Hacked Dating Sites

The US security Hold Security claims that hackers dozens of dating sites have been hacked, with particular dating-related information and login details are stolen. Hundreds of thousands of users would be at risk. However not know which dating sites it will leave the company.

The list was viewed by IDG. According to the news websites between July 4th and last week had been hacked, often via vulnerabilities such as SQL Injection. Hold Security came a year ago in the news when the attackers claimed that 1.2 million passwords were stolen. Even when the company wanted not to know where the data was captured. What the hackers with the now stolen data plan is unknown.

US Sees 245 Successful Attacks On industrial Systems

US industrial systems include critical infrastructure faced last year with 245 successful attacks. That the Industrial Control Systems Cyber ​​Emergency Response Team (ICS-CERT) of the Department of Homeland Security in a new report ( pdf ) let you know.

Most attacks were directed against the energy sector. Furthermore, 55% of the 245 reported incidents would be the work of advanced persistent threats (APT) or "sophisticated actors" are. Other incidents appeared the work of hacktivists, insiders and criminals. In many cases, the attackers because of lack of data could not be traced.

Attack Methods

The attackers used different ways to access the systems, such as the use of zero-day vulnerabilities in control systems and software, SQL Injection in Web applications, network scans, spear phishing and "watering hole attacks." There were also incidents of control systems that were not connected to the Internet, the so-called air-gapped systems were infected with malware. It may be used for this purpose infected removable media.

In most cases it is unknown how the attackers gained access to the systems. ICS-CERT further argues that the actual number of incidents is probably higher than the 245 incidents reported. Organizations in the vital infrastructure are therefore urged to report all incidents, even when there is no need support, so that any other incidents can be found and the method of attackers is clear.