Author: Dan Goodin

Enlarge (credit: @flanvel)

Login credentials for as many as 117 million LinkedIn accounts have been put up for sale online by someone who is seeking more than $2,200 for the haul, a security researcher said.

The credentials—which include e-mail addresses and passwords hashed using the woefully weak SHA1 function—appear to come from a 2012 breach of the career networking site, researcher Troy Hunt said in a series of tweets. LinkedIn officials have since verified that the 2012 hack was the source and said they are working to invalidate any passwords that may still be actively used on compromised accounts. According to LeakedSource, a site that maintains a database of more than 1.25 billion compromised accounts, the new batch contains data for 167 million accounts. 117 million of the records in the batch include a password field.

The discovery means that the 2012 LinkedIn breach was much bigger than previously believed. At the time, researchers found almost 6.5 million credentials belonging to site users. It's not clear if the new number of affected accounts is news to LinkedIn. In the days following discovery of the 2012 breach, company officials implemented a mandatory password reset for affected users. A statement from company officials on Wednesday saying that they're working to change any passwords still in use leaves open the possibility that they were unaware the number was so high.

(credit: anutkak43)

Some people never seem to learn. A recent investigation by security firm Compaas trawled Google Docs and Dropbox and found thousands of sensitive documents belonging to hospitals, schools, and corporations. In many cases, the spreadsheets caused the organizations to run afoul of consumer privacy laws.

"We found a couple hospitals that had breaches in HIPPA compliance," Compaas COO Doran David said. "There was patient information, what types of surgeries they had, social security numbers. Anything that you would think of that you would consider personal is the type of thing we've come across."

In most cases, the documents are uploaded by employees who don't understand the privacy implications of what they're doing. They simply know that Google Docs and similar services are a much easier way to exchange documents than official methods provided by their employer. In other cases, they use misconfigured third-party apps to swap documents with co-workers. The end result is documents that never should have been made public but can in fact be downloaded by anyone.

Enlarge (credit: Merge Healthcare)

A heart patient undergoing a medical procedure earlier this year was put at risk when misconfigured antivirus software caused a crucial lab device to hang and require a reboot before doctors could continue.

The incident, described in an alert issued by the Food and Drug Administration, highlights the darker side of using computers and computer networks in mission-critical environments. While a computer crash is little more than an annoyance for most people at home or in offices, it can have far more serious consequences in hospitals, power generation facilities, or other industrial settings.

The computer system at issue in the FDA alert is known under the brand name Merge Hemo and is sold by Hartland, Wisconsin-based Merge Healthcare. It comprises a patient data module and a monitor PC that are connected by a serial cable. It's used to provide doctors with real-time diagnostic information from a patient undergoing a procedure known as a cardiac catheterization, in which doctors insert a tube into a blood vessel to see how well the patient's heart is working.

More than 36 organizations—some in the gas, telecommunications, and steel manufacturing industries—have been breached by attackers exploiting a vulnerability in older SAP business applications that gives them remote access to highly confidential data, the US government-sponsored CERT warned Wednesday.

The attacks were carried out over the past three years by attackers exploiting the "invoker servlet," which is a set of functions in SAP applications that allows users to run Java applications without use of a password or other authentication measure. Attackers outside the targeted organizations have abused the feature to gain access to sensitive data and possibly to take control over servers that process the data, according to researchers at security firm Onapsis.

"The exploitation of this vulnerability gives remote unauthenticated attackers full access to the affected SAP platforms, providing them with complete control of the business information and processes run by them, as well as potentially further access to connected SAP and non-SAP systems," company researchers wrote in a blog post published Wednesday.

(credit: Aurich Lawson)

For the past month, people infected with the CryptXXX ransomware had a way to recover their files without paying the hefty $500 fee to obtain the decryption key. On Tuesday, that reprieve came to an end.

Researchers from security firm Proofpoint said in a blog post that version 2.006 has found a way to bypass a decryption tool that has been freely available for weeks. The tool was provided by Kaspersky Lab and was the result of flaws in the way CryptXXX worked.

The crypto ransomware update effectively renders the Kaspersky tool useless, Proofpoint said. It did this with the use of zlib, a software library used for data compression. The new version also makes it harder to use the Kaspersky tool by locking the screen of an infected computer and making it unusable until the ransom is paid.

(credit: Ann Oro)

Windows users woke up to something that doesn't happen every day: the disclosure of two zero-day vulnerabilities, one in the Microsoft operating system and the other in Adobe's Flash Player.

The Windows bug is being actively exploited in the wild, making it imperative that users install fixes that Microsoft released today as part of its May Patch Tuesday. Cataloged as CVE-2016-0189, the security flaw allows attackers to surreptitiously execute malicious code when vulnerable computers visit booby-trapped websites. In the days or weeks leading up to Tuesday, it has been exploited in targeted attacks on South Korean websites, according to a blog post published by security firm Symantec. Technically, the vulnerability resides in the JScript and VBScript engines, but IE is the vehicle used to exploit it.

Separately, Adobe officials warned that a newly discovered Flash vulnerability also gives attackers the ability to remotely hijack machines. It was first reported by researchers from security firm FireEye, and exploits exist in the wild. Adobe said it planned to release an update as soon as Thursday.

Enlarge (credit: Ron Amadeo)

For years, critics have bemoaned the sad state of security updates available to hundreds of millions of owners of mobile devices running Google's Android operating system. Now, federal regulators are investigating whether Google, Apple, and the rest of the players in the mobile industry are doing everything they can to keep their customers safe.

In a joint action, the Federal Communications Commission and the Federal Trade Commission are ordering mobile operating system developers, hardware manufacturers, and carriers to explain their rationale in deciding when to issue updates, or as is so often the case for Android users, why they don't provide updates. Two of the more glaring examples are a vulnerability dubbed Stagefright disclosed last year and another disclosed in March called Metaphor. Both allow attackers to surreptitiously execute malicious code on Android devices when they view a booby-trapped website.

"There have recently been a growing number of vulnerabilities associated with mobile operating systems that threaten the security and integrity of a user’s device and all the personal, sensitive data on it," Jon Wilkins, chief of the FCC's Wireless Telecommunications Bureau, wrote in a letter to carriers. "One of the most significant to date is a vulnerability in the Android component called 'Stagefright.' It may have the ability to affect close to 1 billion Android devices around the world. And there are many other vulnerabilities that could do just as much harm."

Enlarge / An image showing a SQL injection attack on the Lee County Elections Office exposing the plaintext passwords of Supervisor Sharon Harrington. (credit: Dan Sinclair)

A Florida man has been slapped with felony criminal hacking charges after gaining unauthorized access to poorly secured computer systems belonging to a Florida county elections supervisor.

David Michael Levin, 31, of Estero, Florida, was charged with three counts of unauthorized access to a computer, network, or electronic device and released on $15,000 bond, officials with the Florida Department of Law Enforcement said. According to a court document filed last week in Florida's Lee County and a video it cited as evidence, Levin logged into the Lee County Elections Office website using the pilfered credentials of Sharon Harrington, the county's Supervisor of Elections. Levin, who authorities said is the owner of a security firm called Vanguard Cybersecurity, also allegedly gained access to the website of Florida's Office of Elections.

Levin posted a YouTube video in late January that showed him entering the supervisor's username and password to gain control of a content management system used to control leeelections.com, which at the time was the official website for the elections office. At no time did anyone from the county authorize Levin to access the site, officials said.

This wizard greets visitors to ImageMagick's website. (credit: ImageMagick)

Attackers have wasted no time targeting a critical vulnerability that could allow them to take complete control over websites running a widely used image-processing application, security researchers said.

As Ars reported last week, a vulnerability in ImageMagick allows hackers to execute code of their choice on webservers that use the app to resize or crop user-uploaded images. Over the past few days, security researchers said, attackers have begun uploading booby-trapped images in an attempt to exploit the vulnerability, which is indexed as CVE-2016-3714. CloudFlare, a content delivery network that helps secure and optimize websites, has updated its Web application firewall to block exploits in an attempt to protect customers who have yet to patch the remote code-execution threat.

"We began watching the exploitation of CVE-2016-3714 as soon as the WAF rule went live across our network," CloudFlare researcher John Graham-Cumming wrote in a blog post published Monday. "The bad news is that this vulnerability is being actively used by hackers to attack websites."