It’s probably obvious why this week’s security brief focuses partly on the scams that came along after Hurricane Sandy hit the United States coast. The “millions” part comes because many of this past week’s headlines contained the word “million.”Let’s elaborate.
First, the French Euromillions lottery website was hacked and defaced by a collective known as Moroccan Ghosts. Apparently, they took aim at the website because they’re against gambling, fact which they clearly stated in the defacement message.
Then, Anonymous hacktivists boasted about compromising 20 million accounts in order to promote the upcoming Operation Jubilee, a live protest scheduled to take place on November 5 in front of the Parliament building in London.
On Wednesday, we learned that Japanese authorities arrested the creators of “The Movie” Android malware. The malicious element is said to have stolen the personal information of 10 million users after compromising the address books of 90,000 mobile phones.
A 419 scam that has been making the rounds in the past weeks informs recipients that the International Monetary Fund and the FBI have their $10 million dollars. All victims have to do is send back an email with their personal details to claim the money.
One group of clever fraudsters discovered a “60 second” vulnerability in CitiBank systems. The flaw allowed them to steal $1 million (800,000 EUR).
While they’ve been clever about the way to get the money, not the same thing can be said when it comes to hiding their tracks. Authorities arrested a total of 14 individuals allegedly involved in the scheme.
Also in the “millions” category, around 1.3 million Facebook accounts were temporarily exposed. Links that could be found via a simple Google search allowed anyone to gain access to some of the accounts without needing a password.
Luckily, Facebook has rushed to disable the feature until things are sorted.
Finally, Team GhostShell hackers have managed to breach the systems of tens of Russian websites, including ones belonging to government, law enforcement, medical, research, financial and telecoms organizations. 2.5 million records have been leaked as a result.
As far as Hurricane Sandy goes, the scams haven’t even started circulating when Avast! experts issued a warning. Then, even the US Federal Trade Commission came forward to warn individuals about charity and home repair scams.
After the hurricane hit the US coast, all hell broke loose, not only in real life, but also online.
Insurance, make-easy-money, Best Buy gift card, stock exchange, and all sorts of other schemes started making the rounds, attempting to trick users into visiting shady websites.
However, there are some interesting events that don’t have anything to do with Hurricane Sandy or with “millions” of any kind.
For instance, Department of Homeland Security Secretary Janet Napolitano made an interesting statement. She revealed that some of the attacks launched against US banks involve stealing money and personal information.
We also learned that ransomware doesn’t necessarily leverage the name of law enforcement agencies to scare victims. Cybercriminals have started relying on the reputation of Anonymous as well.
Since we’re speaking of Anonymous, we must remind you that this week hacktivists have taken aim at Zynga and the systems of Greece’s Ministry of Finance.
Researchers from VUPEN Security claim they’ve already managed to find a vulnerability in Windows 8. The zero-day exploit allegedly works with all mitigation measures set in place.
Georgia’s CERT has some clever security experts, as it turns out. They’ve managed to infect the computer of a Russian cybercriminal with a piece of malware.
They were fed up with the damage he was causing so they took a picture of him and published it in their report.
Finally, if you’re in the mood to read a short interview, we recommend the one we had this week with Peter Doggart, senior director of global marketing at Crossbeam Systems. We talked about the challenges faced by mobile network operators now that millions of new devices are about to “invade” their networks.