US Gets Email System Offline To Remove Malware

The US State Department has an unclassified e-mail system was taken offline to remove malware that already four months on the network would operate. The malware was discovered in November, when the e-mail system was taken offline and measures were taken.

Last month, however, there appeared a report in the Wall Street Journal that the malware still was not completely removed.Now let government officials across ABC News that a last attempt is made ​​to clean up the system. In a statement on their own website says the ministry because of several security enhancements to the network shortly maintenance will find the system. There were certainly no classified systems or financial consular or HR systems are compromised.

"The recent increase in news stories about cyber incidents shows that the Department on a list of public institutions and companies are having to deal with an increasing number of sophisticated cyber threats," the statement said. In addition to a team of experts from other ministries and the private sector to protect the data of the Ministry, would be a strategy simultaneously performed to better secure the infrastructure of the Ministry. How the malware on the e-mail system was able to get was not disclosed.

"IP addresses are insufficient evidence against North Korea"

The evidence that the United States against North Korea when it comes to the hack of Sony is weak, says a security expert who analyzed the IP addresses used in the attack. Last week, the FBI said in an official statement that the Asian country was responsible for the intrusion on the network of Sony Pictures Entertainment, the theft of all data and sabotage of thousands of computers.

However, the FBI is careful in the words chosen, says security expert and blogger " krypt3ia ". He sees in the choice of words that the investigative unsure. Initially the attack was linked not to North Korea by the FBI, and is now said that the country is the culprit. "Something that makes people like me crazy," he notes. The expert therefore decided to look at the IP addresses used by the malware and introduced himself, the question of whether the resources are to be used or used only by North Korea.

IP Addresses

The IP addresses that the attackers used are from Thailand, Poland, Italy, Bolivia, Singapore, Cyprus and the United States.These include for which proxies and servers can be used by anyone. For one of the servers Krypt3ia found the credentials on a Chinese forum. The IP addresses appeared more frequently used for other cybercrime activities such as sending spam and controlling compromised computers.

"If all IP addresses are used by the US as evidence that North Korea has carried out this attack, I think the evidence is weak," said the expert. Most of these systems are in fact well-known compromised machines that are used for all kinds of cyber crime purposes. Also, many of these types of compromised servers are shared by attackers with each other.

North Korea has used such tactics in the past, according to the expert circumstantial evidence that is inadmissible in court.However, Obama announced that the US will take appropriate action against North Korea. The expert then also questions whether the US base their theoretical response on circumstantial evidence, which he makes reference to the so-called weapons of mass destruction in Iraq. Further, according to the expert whether there because of a break-in at a single entertainment company in Hollywood should be acted upon at the state level. "When I go to Twitter and the news I see is marketing hype and unjustified award ... and it will lead to our mutual destruction," concluded the blogger.

Critical vulnerabilities Found in Network Time Protocol (NTP)

Researchers at Google have critical vulnerabilities in the Network Time Protocol (NTP) allowing attackers discovered on systems that use NTP can execute code. NTP is a protocol that allows systems to synchronize the time for different services and applications.

It is used among other things on a large scale industrial systems. Neel Mehta and Stephen Roettger of the Google Security Team discovered several vulnerabilities in the protocol. In the worst case, an attacker by sending a single packet to cause a buffer overflow, and it is now possible to carry out on the attacked system code with the rights of the NAP-process. This vulnerability is present in all versions of NTP NTP-4.2.8.

Before warn the the Industrial Control Systems Cyber ​​Emergency Response Team (ICS-CERT) of the US Government, the US Computer Emergency Readiness Team ( US-CERT ) and the CERT Coordination Center ( CERT-CC ) at Carnegie Mellon University. Administrators also are advised to upgrade to NTP 4.2.8. Furthermore, this version fixes vulnerabilities in the random number generator allow an attacker to retrieve certain information. Exploits that make the leak abuse have been found on the Internet, according to the ICS-CERT

Sony Pictures Hacked By #GOP (Guardians of Peace)

Previous Sony Pictures (Sony Pictures) computer was hacked US subsidiary, approximately 11TB of important information stolen, GOP (Guardians of Peace) Sony hacker group said the company did not meet their demands, the company did not release more than the movie exposure on the network, speculation Sony Corporation to assassinate Kim Jong-un as the theme of the movie "The Interview" is about to be released, is likely to startle events related to the DPRK.

November 25, 2014, Sony Pictures, the US branch office network is attacked, all office computers are not available, the hacker also left a signature "Hacked By #GOP" and requires the Sony computer and stole Important information about 11TB, mainly some financial documents and password file, the hacker left a message is displayed if Sony Corporation can not meet their demands on the network will be open and stole documents. The incident led to Sony Pictures was hacked office can not work, e-mail and phone systems are all paralyzed.

The Interview - Official Teaser Trailer - In Theaters This Christmas

According to the Re / code website reported, Sony company is investigating whether the incident was related to the DPRK startle. Sony Pictures's latest film The Interview will be December 25, 2014 release, the film tells the story of two American CIA was hiring a reporter to interview, citing the story of trying to assassinate Kim Jong-un, although this is a comedy, North Korea still aroused strong protest, saying it was an unforgivable blasphemy against the Korean people, if the movie release schedule, the DPRK will launch a merciless counterattack, North Korean government has also sent a letter to the Federation Council's Secretary-General Ban Ki-moon, accusing Sony acts of terrorism.

A thread on Reddit provided information on what hackers could have stolen from the Sony pictures system. According to the thread, the data might contain passport and visa information for cast and crew working on Sony movies, Outlook inboxes, documents detailing the company’s IT systems plus accounting and research information- but all this is just a small part of this gigantic breach.

But, this is a surety that most of the data from the breach would be video files and some of them might be pirated movies downloaded by the Sony staff.

• Adventure Time-2x04a-Power Animal.avi
• Adventure Time Her Parents.avi
• Adventure Time The Silent King.avi
• Adventure Time-2x09b-Susan Strong.avi
• Adventure Time-2x11a-Belly of the Beast.avi
• Human.Planet.S01E05.720p.BluRay.x264-SHORTBREHD.mkv
• Human.Planet.S01E02.720p.BluRay.x264-SHORTBREHD.mkv
• Human.Planet.S01E06.720p.BluRay.x264-SHORTBREHD.mkv
• Human.Planet.S01E03.720p.BluRay.x264-SHORTBREHD.mkv
• Human.Planet.S01E04.720p.BluRay.x264-SHORTBREHD.mkv
• Human.Planet.S01E01.720p.BluRay.x264-SHORTBREHD.mkv
• Human.Planet.S01E07.720p.BluRay.x264-SHORTBREHD.mkv

During the week, Sony tried to get its systems up and also analyzed the damage conceded by their systems due to the breaches. But, mid-week four of the Sony movies were uploaded, each within space of few minutes. Only one of these was released in USA, their names are as follows:

• ‘Still Alice‘ starring Julianne Moore, Alec Baldwin (US date: Jan 16, 2015)
• ‘Mr Turner‘ starring Timothy Spall. (US date: Dec 19, 2014)
• ‘Annie‘ starring Jamie Foxx and Cameron Diaz. (US date: Dec 19, 2014)
• ‘Fury‘ starring Brad Pitt (US date: Oct 17, 2014)

However, there is no official word from Sony but a page from torrent site 1337x says that a user uploaded these video and will reveal another soon that is of an upcoming movie (To Write Love on Her Arms) whose release data is March 2015.

One of the sets from the data involves files that might be of significance to the piracy watchers. List of files below were used by the company Audible Magic and relate to the automatic content recognition systems.

• audible_magic_sftp_private_key.ppk
• audible_magic_sftp_private_key.ppk
• set_ssh-private-key-file.htm
• audible_magic_sftp_private_key.ppk
• private_and_private_key.txt

So, it now makes upcoming week lot more fascinating as it remains to be seen how many uploads hackers will do during the week. But, one thing is for sure these hacks will hurt Sony badly not just for months but for many upcoming years.

US Parking Malware

The payment of various car parks in the United States are infected by malware, where possible, data from credit and debit cards from an unknown number of customers have been stolen. Before warns SP Plus an American company that parking services offered to owners of real estate, such as shopping malls and offices.

SP Plus received a message from the provider that manages the payment systems in the parking garages. An attacker could access the remote access tool received from the supplier and so could log on to the payment. There installed the malware attacker could intercept the data of payment cards which was settled in the car parks. It would be the cardholder's details (cardholder's name, card number, expiration date and verification code).

In all, 17 parks have been affected. Whether there actually map data can be stolen SP Plus does not say, but the company decided to issue a warning. Meanwhile, the malware would be disabled on all affected systems. In addition, the company's supplier obliged henceforth to use two-factor authentication when logging on to the payment.

17 SP+ Affected Parking Location's

India is fighting botnets computers with cleaning center

The Indian government is planning to establish that engages in the fight against botnets. A special "cleaning center" In recent years, the number of Indian computers part of a botnet has exploded. In 2007 it went to some 26,000 systems.

In the first half of 2013 the number of bots, however, rose to 4.2 million systems . The increase is explained by the growing Internet usage in India. In addition, it is not just computers that become infected, more and more smart phones would become part of a botnet. Therefore, the government now wants to start a center to end the infection must, along with internet providers said the Deccan Herald.