Image via Wikipedia

According to DreamHost’s Status and Blog, staff noticed some unusual activity on one of their databases that held user login information for shell accounts. While the passwords were mostly  encrypted, hackers “hacker found a legacy pool of unencrypted FTP/shell passwords in a database table that we had not previously deleted,” according to  DreamHost CEO Simon Anderson.

As a precaution, ALL shell/FTP account passwords were reset by DreamHost. While it will cause some inconvenience for users trying to access their sites over SSH/FTP, the implications are much more serious. A lot of CMS systems store their database username and passwords in plaintext on configuration files. If whoever gained access to DreamHost’s shell account database and managed to decrypt the information, then they would have unmitigated access to not only sites’ files, but they could potentially (and most likely) gain access to the back-end database driving those sites with all user data. This could be a very major breach of user data from one of the largest web hosts in the United States.

DreamHost is being unusually mum about the technical details about the hack and is angering customers over their negligence regarding out-dated server software. While most front-end software is kept up-to-date, their back-end software is grossly outdated and there appears to be no real effort nor care by DreamHost to keep OS and back-end software updated. What makes things worse is that DreamHost’s official stance on their security solution is to not disclose what technologies they use. Rather than taking a proactive and relatively transparent stance to their own security systems, the company has decided to take-up a reactive and a “security through obscurity” stance.

Related articles

• DreamHost Security Issue Prompts FTP Password Resets (sucuri.net)
• Changing Shell/FTP Passwords due to Security Issue (dreamhoststatus.com)
• Security Update (dreamhost.com)

Computer virus hits US Predator and Reaper drone fleet.

 The firm described the data theft as "significant" saying names, addresses, phone numbers and dates of birth were all taken on 3 June.

The company has since taken its website offline and visitors are now directed to Codemasters’ Facebook page for the meantime. This is yet another example of companies learning the hard way that IT security infrastructure is not something that should be neglected.

Details on who was responsible for the theft and methods used to carry out the attack are as of yet unknown.

The targeting of Sony stems from their legal assault on George Hotz, otherwise known as GeoHotz, who had found and published a way to circumvent protection mechanisms on the PlayStation 3. This was a big deal after the company removed the “Other OS” feature through a firmware update that allowed the installation of Linux on the console to use the powerful IBM Cell processor that powers the machine. The PS3 has been known to be used by organizations like the US Air Force in supercomputer clusters due to the Cell processor’s vastly superior floating-point performance which is highly desired for processing large amounts of data for modeling.

Stay tuned…

More Info Over at SANS ISC and thanks goes to Briareos over at BroadBand Reports for the quick fact-finding and possible discovery.

June Security Advisory posted by F5 on identifying any suspicious activity and mitigating the exploit

The Zeus trojan has been known to steal user data in the past, but has never been used in such a direct manner. In the US, there are believed to be 3.6 million infected machines by the malware alone, which makes it arguably one of the world’s most dangerous trojans/botnets in terms of potential damage. The Daily Mail has a good article outlining the exact details.

M86 Security Whitepaper (PDF)

What makes it so hard to remove is its inability to be cracked. It has used the MD6 cryptographic hash function that was a candidate for the NIST SHA-3 Hash Competition with a 4096-bit RSA key. Even when a buffer-overflow vulnerability was discovered in MD6, the botnet’s owner corrected the implementation within a matter of days. There is an entire working group called The Conficker Working Group tasked entirely to the botnet, which has yet to break-in and take any sort of control away from whoever runs it.

In-depth article at The Register

It is not known if the laptop in question has been secured with disk encryption or any other type of techniques used in attempt to keep data from unauthorized parties.

As of writing this, the MoD has been bluntly quiet on the incident saying only that “An investigation is ongoing.”

Heads up to The Spy Blog UK for highlighting this

At first, T-Mobile tried to say it was just a list pulled from a corporate document; but now the company is admitting that it was, in fact a major security breach according to a USA Today Blog and are not disclosing how much data was taken. Odds are, if whoever managed to get this far, a very sizeable amount of data was captured. The person who made the posting mentioned that they had tried to sell the information to competitors, but they were not taken seriously.

On a slightly related note, the posting related the T-Mobile hack with Check Point. Does this mean a perimeter Check Point firewall was either hacked or exploited to gain access to this network? Only further elaboration from Pwnmobile, T-Mobile, or an insider can say. There have been several recently published high-visibility Check Point exploits and perhaps they were used in the hack.