Search the Community

Hi All, As or the title and here is the article: https://www.securityweek.com/laptop-maker-framework-says-customer-data-stolen-in-third-party-breach/ The first few paragraphs give the story: Rather a shame but it seems more and more likely that it's when companies are breached not if Kind Regards Simon Zerafa

Summary Laptop manufacturer Framework Computer, Inc. has privately informed affected customers that their data was compromised in a third-party data breach. An employee at an external accounting partner, Keating Consulting Group, inadvertently shared customer information with attackers who exploited a phishing email. The breach apparently only affects people associated with outstanding balances for Framework purchases. However, it's worth noting that, according to some Framework forum members, they have received the compromise notification emails even if their last purchase was fully paid and fulfilled more than two years ago. Quotes: My thoughts While Framework has taken intimidate measures to address the situation, such as notifying affected individuals and warning them about potential phishing e-mails they might receive, as well as implementing mandatory phishing training for employees with access to customer information... No public official statement has been issued yet (that I'm aware of, please correct me if I am wrong). I've seen some people commending them for their transparent approach to this issue, however it seems* to me they just did what the law required them to do: * I am not a legal professional, and I am not a resident of California or the USA. Sources https://www.bleepingcomputer.com/news/security/framework-discloses-data-breach-after-accountant-gets-phished/ https://community.frame.work/t/framework-data-breach/43408

Summary An ex-Ubiquiti engineer, Nickolas Sharp, was sentenced to six years in prison yesterday after pleading guilty in a New York court to stealing tens of gigabytes of confidential data, demanding a $1.9 million ransom from his former employer, and then publishing the data publicly when his demands were refused. Quotes My thoughts This was coming for him. More than this, he even tried to feed this fake breach info to Krebs on Security who wrote multiple articles defaming Ubiquiti causing their stock to tumble as per their own words. I remember this was discussed last year in WAN show when this came out, so I hope we get to see final thoughts of Linus and Luke on WAN show on this final news. Sources https://arstechnica.com/tech-policy/2023/05/ex-ubiquiti-engineer-behind-breathtaking-data-theft-gets-6-year-prison-term/

There was a discovered leak from Verizon that has been reportedly been leaking customers' information, potentially for months, due to a flaw in a chat system on their website. This event caused addresses, phone numbers, account numbers, and other personal/private information to be leaked. Verizon's response: “We’re looking into an issue involving our online chat system that assists individuals who are checking on the availability of Fios services. We believe a small number of users may have seen a name, phone number, and/or a home or building address from an unrelated individual who had previously used this chat system to enter that information. Since the issue was brought to our attention, we’ve identified and isolated the problem and are working to have it resolved as quickly as possible.” TL;DR Flaw discovered in Verizon's chat system on their website Leak caused personal/private information to be leaked (Addresses, phone numbers, account numbers, etc.) Check your security/profile & change password just in case Article: https://hotforsecurity.bitdefender.com/blog/verizon-leaks-customer-conversations-personal-data-through-flawed-chat-window-on-its-website-24708.html

https://www.wordfence.com/blog/2020/05/28000-godaddy-hosting-accounts-compromised/ https://www.techrepublic.com/article/godaddy-data-breach-shows-why-businesses-need-to-better-secure-their-customer-data/ This is hosting accounts of theirs. So, DNS users get a pass this time 'round. While they haven't said it is related, this could be additional persistent threat fallout from the March GoDaddy employee phishing breach. https://krebsonsecurity.com/2020/03/phish-of-godaddy-employee-jeopardized-escrow-com-among-others/ In short, if you use GoDaddy for anything, especially hosting at this time, you should go change your ssh keys and set up 2 factor auth if you're able. Also, check the history of files and minor edits in your sites (particularly if you're using any of the popular CMSs), as this is notification NOW of a breach that appears to have occurred last October.

Yesterday the news broke of a bug on Instagram servers that leaked email-addresses and phone numbers of "high profile" users. As can be read here: https://arstechnica.com/information-technology/2017/08/celebs-phone-numbers-and-e-mail-addresses-exposed-in-active-instagram-hack/ However, just out is a new article on this matter: https://arstechnica.com/information-technology/2017/09/site-sells-instagram-users-phone-and-e-mail-details-10-a-search/ And its MUCH, MUCH bigger.... Someone is claiming to have exploited above bug and build a database of data belonging to 6 million users, containing email-addresses and phone-numbers. This dude is selling the data with a searchable website charging $10 per query! Also apparently it wasn't as "labor intensive" as first thought: It is not confirmed yet if this data is legit. But it is assumed that it is. Security researched Troy Hunt: And from the article: This is some quite bad news honestly. A database of millions of users, not only exposing email-addresses (yay spamlists...) and phone-numbers. But actually tying those together! I think that's data that's immensely valuable to people who want to successfully impersonate other people. We all remember the time linus' twitter got hacked and there it was his phone-number that was key part of how it was done. Lets hope it becomes clear as soon as possible if this data is actually legit (but lets assume it is) and I really wonder how Instagram/Facebook will respond to this..

https://www.upguard.com/breaches/facebook-user-data-leak Security researchers from UpGuard have just found yet another cache of Facebook user data. Two Facebook integrated apps, "Cultura Colectiva", and "At the Pool", hosted the data on unsecured Amazon S3 (Simple Storage Service) instances, which were configured to allow anyone to download the data. One app, "Cultura Collectiva" had not responded to notification of the breach or otherwise secured the data until it and Facebook were contacted for comment by Bloomberg. The other app, "At the Pool" has since gone offline, and the researchers believe the parent company has gone under given their site returns a 404. The contents of their database breach is incredibly concerning, as it contained more than 22,000 plaintext passwords, emails, and names, and has likely been public since 2014. Despite Facebook's recent efforts towards more responsibly handling the data they collect on their users, there is no putting the cork back after their reckless and frankly irresponsible handling of their users data in the past. More of these databases are likely still out there, unsecured or otherwise, and there is no taking that back. As always, be security conscious online, because you never know who has your data, or where they're putting it.

Edit: This has grown a bit, so I am going to modify the post to add more info from the article to make it easier to parse: This is an important thing for anyone who interacts with e-commerce retailers. As the web evolves sites open and close, some big, some small. When the big ones fall, what happens to your data? In one very big and public case the worst thing that could happen, happened. If you've ever bought anything on NCIX before it went defunct, worth a read. Especially important considering Linus's history with NCIX - perhaps some of his own data is breached as part of this brokering. https://www.privacyfly.com/articles/ncix_breach/ --- Sort of a TL;DR: On August 1, 2018, A Craigslist ad was discovered purporting to be selling two servers, one a Database Server from the now-defunct NCIX and another, a Database Reporting Server. The seller claimed to have acquired both from Vancouver based Able Auction’s. After some back and forth, a meeting was arranged where the data could be viewed. The server contained some XML documents with usernames and passwords and database references but no data. When inquired the person selling stated the had the network storage as well as NCIX’s entire server farm from the east coast which was shipped back to their Richmond warehouse several months previous. Which was only the beginning... As the story developed, the source of quite a bit of the information came to light: A further ~300 desktop computers from NCIX’s corporate offices and retails stores, 8 DELL PowerEdge servers, as well as at least two Supermicro server’s running StarWind iSCSI Software as backup servers. There were also 109 Hard Disks pulled from auctioned servers. Also, and this is something VERY important for those who have ever had computer repairs done at NCIX: A large pallet of 400-500 used hard drives from various manufacturers. Let that bit sink in. CUSTOMER's PERSONAL data. In another face-to-face meeting, more data was reviewed on some of the SuperMicro servers, as well as the Desktop machines used by NCIX staff. On the desktop and discovered that it was used by a former NCIX employee named Chadwick Ma. The computer contained a treasure trove of confidential data including credentials, invoices, photographs of customers ID’s, Bills, and Mr. Ma’s T4 among other files. It was safe to assume the other desktops probably contained even more information about other employees. On the SuperMicro backup server: A rundown of the types of information contained in the UNENCRYPTED storage and databases: nciwww database contained a thousand records from affiliates listing plain text passwords, addresses, names, and some financial data Customer service inquiries including messages and contact information three hundred eighty-five thousand names, serial numbers with dates of purchase, addresses, company names, email addresses, phone numbers, IP addresses and unsalted MD5 hashed passwords. full credit card payment details in plain text for two hundred and fifty-eight thousand users between various tables. OrdersSql_Data, it contained many versions going back 15 years with the most recent dated in 2017. The version I opened contained three million, eight hundred forty-eight thousand records covering January 2007 through July 2010. Contents included names, company names, items purchased with serial numbers, addresses, phone numbers, and payment data. Financing programs Employee records Vendor pricing Confidential company emails Source Code intellectual property from NCIX’s ventures into manufacturing Other confidential data The final important bit about what was really happening to the data and that it was really and truely up for sale to the highest bidder: Please, let's not underestimate the impact here. Not only does this effect if you've purchased hardware from NCIX at any point in the last 15 years. This impacts if you have ever worked for NCIX as an employee or contractor. If you've ever had a vendor agreement with them, if you've ever communicated with them in any way, if you've received service from them in the form of repairs, especially up to the point where they declared bankruptcy. Your confidential and personal information is blown to the wind. Depending on your relationship to them the damage goes from inconvenient to outright life changing.

I got a security notice from Microsoft on my computer. I changed my password (Both passwords plenty secure, >20 chars, 100-150 bits, no standard English words, password unique to account) and checked my account history. There were a couple of successful sign-ins from Saudi Arabia, Japan, Spain, Indonesia, France, Jamaica, Korea... As well as attempts from Antigua and Barbuda, Span, Russia, Moldova, etc dating back to about last month. What the hell? Am I being targeted or some shit? I can only hope they didn't touch my other accounts. I'll be doing a full scan on every desktop and laptop that I'm signed in to, but other than a Virus, why and how would anyone want my account? Has anybody else been "targeted" like this? At >20 chars, I'm assuming social engineering or a virus was used to get my password. Any tips?

Sorry if this is in wrong topic but I couldn't post in the forum discussion page for some reason well i use a steam logon to use this website and I am afraid of my steam account being hacked (I own like 300 bucks worth of csgo knives) Is there a need for me to reset my password? I use email confirm and email logon so to trade anything from my account the hacker would need to also have my email and they are different passwords. Do I need to change my email or steam password? D: Thanks for replying

Company claims Apple is developing a large-scale battery division to compete Oh Apple, not the breach of contracts! It seems that in their desire to go hard on building out their car/battery/whatever empire, they might have stepped on some non-competes that prevented A123 employees from leaving. The interesting part? A123 had government backed funding BUT they are in bankruptcy, as my source quoted below says. On one hand, A123 is selling off assets and has employees so crucial that if they leave, entire projects have to be shut down; on the other they are suing Apple for hiring employees to a company that is a tad more stable for their future careers. http://www.theguardian.com/technology/2015/feb/19/apple-lawsuit-poaching-engineers-electric-car

Target seems to be having fun lately, what with their write-off in the absolute failure of Canada and now reporting how much their credit card snafu cost them. Thats quite a lot of cheddar. I don't feel bad. If you can't even secure credit card data, what good are you? This is why I'm hoping contactless payments become more prevalent and even more secure. I'm buying something. I don't need you storing any of my information on any level whatsoever and until you retailers start securing your information (or stop collecting it all together, ideally), you can have fun getting reamed by all the fraud that will be thrown upon you. http://techcrunch.com/2015/02/25/target-says-credit-card-data-breach-cost-it-162m-in-2013-14/

"Uber waited more than five months to notify drivers whose names and drivers-license numbers were taken in a computer-security breach last year, much longer than allowed by many state laws. In California, Uber’s home state, the law requires companies who lose consumer names and another piece of personal information, including a driver’s license number, to tell those affected "in the most expedient time possible and without unreasonable delay." Most state laws covering breach notification use similarly vague time limits. Among states that offer specific guidelines, none is longer than 60 days. Uber said more than 20,000 of the affected drivers were in California, but declined to specify any other states affected. The company has notified the California attorney general of the breach." "Unless they were cooperating with law enforcement, which is a possibility, it would seem to be an unusual delay," said Brian Finch. Source: http://blogs.wsj.com/digits/2015/02/27/uber-breach-exposes-50000-driver-names-and-license-numbers/

Summary Eufy cam users saw other users' cam feeds in their apps and are now (obviously) worried that others' could see theirs. While a re-login helped, others might still be able to access their cameras... Quotes My thoughts I feel terrified thinking about others seeing my children with me having no control whatsoever. Luckily I don't have any cameras installed in the house, at least none that are permanently powered on and/or connected to the internet. I think in a situation like that I'd do the exact same thing as the 9to5mac article suggests: "For now, the smart thing would be to disable all Eufy cameras." Edit/Update: Eufy has confirmed the claims/reports and provided a "solution" on twitter: Sources https://9to5mac.com/2021/05/17/huge-eufy-privacy-breach/

Summary it seems to be the largest breach. 8,459,060,239 unique entries were leaked (date base that has been stored for 12 years) 100GB TXT file was shared on one forum. Quotes My thoughts This is so far the largest breach in history! Nearly all online population is affected. So we all need to check haveibeenpwned (when it will be updated) . Sources https://cybernews.com/security/rockyou2021-alltime-largest-password-compilation-leaked/

Source: https://arstechnica.com/tech-policy/2017/09/equifax-cio-cso-retire-in-wake-of-huge-security-breach/ Thoughts: Hopefuly the company can finally take action against this security breach with the new interim CIO's and help those 143 million americans get their stolen information back. Since that so many other crediting services and other companies rely heavily on the Apache Struts, I think that Equifax's patching efforts are very poor when it comes to the security of many different comapny's that rely on this web server application, because if Equifax "fully" understands the huge focus on patching efforts, I wonder how long it will take them to release more addition information when it is available since they didnt take much action about the 143 million americans stolen identities. In future, I think that when somehting else like this happens again, Equifax needs to take more action within helping those people affetced and getting their personal information back.