Home

STEALTHbits security experts: larger implications of United Air hack

United Airlines, the world's second largest airlines, disclosed on July 29th that it was breached in May or early June of 2015. It is believed the attack was the work of a group of China-backed hackers behind other major breaches including the Anthem breach. Stolen data includes manifests with information on flights' passengers and destinations. United may be getting assistance from Fed investigators now working on the OPM hack. There are indications that the hackers may have been in the network for months. A domain for the attack was established in April 2014, registered by a James Rhodes, a name that's the alias of "War Machine," a character in Marvel Comics’ Iron Man (experts tracking the OPM hackers note their frequent use of Marvel comic book references).

: INTERNATIONAL SECURITY EXPERTS; Talking Point; Posted On Friday, 31 July 2015 11:13

Wargaming reveals WG Labs

Wargaming has launched WG Labs, a lean and agile platform designed to foster innovation within the videogames industry. This platform will support external development teams in game creation and publishing, as well as generate, evaluate, and launch in-house products that go beyond the company's paradigm.

: Frazer Nash; International Security, Safety & Strategic Defence; Posted On Friday, 31 July 2015 11:08

Criminals spying on high-value targets in Ukraine, Russia and Belarus, and their encrypted data

ESET is today issuing an analysis on Operation Potao Express, the cyberespionage group behind the Win32/Potao malware family.

Potao is an example of targeted espionage (APT) malware detected mostly in Ukraine and a number of other CIS countries, including Russia, Georgia and Belarus.

Among the victims that ESET was able to identify, the most notable high-value targets include Ukrainian government and military entities and one of the major Ukrainian news agencies. The malware was also used to spy on members of MMM, a financial pyramid scheme popular in Russia and Ukraine. One of the most interesting discoveries during ESET’s Potao investigation and research was the connection to a Russian version of the now discontinued popular open-source encryption software, TrueCrypt. The website truecryptrussia.ru has been serving a Russian language localized version of the TrueCrypt application that also contains a backdoor, in some specific cases. The trojanized version of the application is only served to selected victims which is another indicator of targeting by the malware operators and also one the reasons why the backdoor has gone unnoticed for such a long time. In addition to serving trojanised TrueCrypt, the domain also acted as a C&C server for the backdoor. The connection to Potao lies in the fact that Win32/Potao has been downloaded in a few cases by Win32/FakeTC (ESET detection name of the trojanized encryption software).

: Iva Kuosseva; InfoSecurity; Posted On Friday, 31 July 2015 11:01

University of Derby helps secure more than £1.9m to improve research into policing

Vigilance can report that the University of Derby, in collaboration with a number of police forces, other universities and agencies, has helped to secure more than £1.9m from the Police Knowledge Fund to help improve research into policing.