Thursday, September 27, 2012
Wednesday, September 26, 2012
100k IEEE site Plain-Text Passwords found on Public FTP
A Romanian researcher – Radu Drăgușin found that
100000 usernames and passwords of the Institute of Electrical and
Electronics Engineers (IEEE) was stored in plaint-text on
a publicly accessible FTP server.
According to him, on Sept. 18 he first discovered a log with
usernames and passwords in plaintext, publicly available via IEEE’s FTP
server for at least a month. He informed them of his find yesterday, and
evidently the organization is addressing the issue.
On the FTP server, according Dragusin were the logfiles for the
offers and ieee.org spectrum.ieee.org – Total data to approximately 376
million HTTP requests. Including 411,308 log entries with login and
password in plain text.
Among the users who’s information was exposed are researchers at
NASA, Stanford, IBM, Google, Apple, Oracle and Samsung. IEEE’s
membership of over 340,000 is roughly half American (49.8 percent as of
2011).
“IEEE suffered a data breach which I discovered on September
18. For a few days I was uncertain what to do with the information and
the data. Yesterday I let them know, and they fixed (at least partially)
the problem. The usernames and passwords kept in plaintext were
publicly available on their FTP server for at least one month prior to
my discovery. Among the almost 100.000 compromised users are Apple,
Google, IBM, Oracle and Samsung employees, as well as researchers from
NASA, Stanford and many other places. I did not and will not make the
raw data available to anyone else.” Message posted on researcher’s site.
Source: THN
Billions of Windows Users Affects with Java Vulnerability
Researchers at Security Explorations disclosed a new vulnerability in
Java that could provide an attacker with control of a victim's
computer. The researchers have confirmed that Java SE 5 – Update 22,
Java SE 6 – Update 35, and Java SE 7 Update 7 running on fully patched
Windows 7 32-bit operating systems are susceptible to the attack.
This
Flaw allowing a malicious hackers to gain complete control of a
victim’s machine through a rigged website. The affected web browsers are
Safari 5.1.7, Opera 12.02, Chrome 21.0.1180.89, Firefox 15.0.1, and
Internet Explorer 9.0.8112.16421.
Though Oracle
released a fix for the most critical vulnerabilities reported by
Security Explorations on August 30th, the security firm quickly found
another flaw in that fix that would allow a hacker to bypass the patch.
That bug in Oracle’s patch still hasn’t been patched, leaving users
vulnerable to both the new flaw and the previous attack.
SOURCE: THN
Tuesday, September 25, 2012
Subscribe to:
Posts (Atom)