Group Claims It Was 'Paid to Hack PBS,' Then Leaks a Million Sony User IDs - FoxNews.com

This is a fantastic story; but I bet most would miss why this group (whoever it was) was able to post individual’s passwords for all the world to see.

Apparently the bigger the company, the more relaxed they are about cyber security and following the very basic of rules.

Had these companies followed “Security 101” procedures they would have known to (at the very least) store passwords in either a HASH or some other encryption so that even if their database of user names and passwords is stolen they can’t be used; or at the very least be posted online somewhere for the whole world to see.

I know in my little corner of the world where I help write software applications for these big companies I have to undergo security questionnaires (sometimes over 100 pages of questions) and audits where they actually try to hack my code. The sad thing is that they are companies the size of the ones in the Fox News story (link below).

If you are about to purchase software for business or pleasure ask “Do you encrypt stored passwords?”

If you are a developer don’t think for a second that the guys doing the networking and managing the firewall and intrusion detection are doing their jobs. Follow the basics, and step one is only store passwords in their encrypted format.

Group Claims It Was 'Paid to Hack PBS,' Then Leaks a Million Sony User IDs - FoxNews.com

LAWTRAC 2011 User Conference

The Corporate Legal Department maintains the most sensitive information a corporation can have.

Just to give you an idea on some of the things they may work on:

• Employment agreements
• Civil matters of senior officers
• R&D Work (patent and trademarks)
• Litigation

If a person can get to the data and documents maintained by the legal department they can ascertain trade secrets and more.

For example:

A national retail chain store will experience mishaps by shoppers who will in-turn file a lawsuit. Nine times out of ten the parties will settle out of court. The store wants to insure the person recovers from any injuries while preserving their reputation as a safe place to shop.

If a person were to obtain a copy of the last 50 or so settlements, they can then make a determination as to what the company will automatically settle for. A person goes into the store, fakes a mishap and asks for just less than what the store will fight over.

If your company has a legal department, you need to attend this conference.

LAWTRAC 2011 User Conference | Agenda | powered by RegOnline

Today's Caption

Put your caption in the comments.

ColdFusion Functions Reference

ColdFusion programmers: New information about CFZIP and CFFile have been posted in my CF-ToolBox.

Take a peak.

And don’t forget if you  would like to see some information about some of the new stuff in CF 9 just drop me a note: Jim@CF-ToolBox.com

Jim's ColdFusion Functions Reference

Google Gmail Accounts Hacked From China

The Great Wall isn’t going to protect your gmail account; this time the hackers are hiding behind it.

According to the San Jose Mercury News Google verified that individual email accounts were the target of these attacks. Accounts belonging to US Officials, Journalists, Businessmen and women, just about anyone who uses their Gmail account to talk about work.

The attack they used is called “Spear Phishing”.

In this kind of attack the gmail user ( YOU ) receives an email from someone they may know with an attachment. When you click it it takes you to a screen where you believe you must authenticate your gmail user name and password…. BUT IT ISN’T GOOGLE – IT IS THE HACKERS.

You fill out the user name and password and then it redirects you back to your regular gmail email interface.

You think your computer just forgot it was already on Google for a second… opps.

Advice / How To Avoid This

Look at the address of the website asking you to fill-out the authentication form. If you think you are on Google, but the address does not have “Google.com” anywhere in the address STOP.

Close your browser (to delete any non-persist ant cookies) and the next time you are on your google mail account delete the message. No need to forward it to Google – they and the FBI are already aware of the problem.

Google Gmail accounts hacked from China - San Jose Mercury News

PLEASE post this to your Facebook account and forward to any of your friends who have a Gmail account.

Two security firms hacked.

Hackers are getting bold. After groups saw that they could get a lot of publicity taking on Sony they are now going after security companies themselves.

I used RSA secure ID’s for years to gain access to servers. I’m aware of at least two businesses that use these ever-changing numeric code methods to do their business banking.

The hackers are trying to gain access to certain pieces of code that would allow them to replicate the numeric code.

If they are successful, this breach will effect more than double the number of accounts that were effected by the Sony breach of security.

So let’s take that to the next level.

It’s not just RSA and your business banking accounts they are after. The other major firm being attacked is L-3 Communications; the company that provides Secure ID authentications for the White House, The Pentagon and others.

And these attacks will be successful one day.

What Can You Do?

Those accounts you have that use a changing number key; you’ll need to change your passwords on a more regular basis. If they ever are able to steal the code that replicates the number key and download the customer’s users accounts then they will have access to your accounts.

• By changing your password on these kinds of accounts more often then you normally would you can add an extra level of protection for yourself.
• Make sure you are in communication with your bank. If you notice odd activity in your account let them know right away.

Cyber threat debate: Two security firms hacked - International Business Times

Today's Caption

Add your caption in the comments.