16-31 June 2014 Cyber Attacks Timeline

I do not know if being happy or not, but it looks like the second half of June (the first timeline covering 1-15 June is here) has seen a sharp inversion of the decreasing trend recorded on the last few months. I have registered an increase of the number of attacks with particular focus on targeted attacks.

The cyber crime front offered several noticeable events, targeting, just to mention the most devastating cases: AT&T, Evernote, the State of Montana (1.3 million single individuals potentially affected), and Butler University.

Moving to hacktivism, the cyber temperature is still high in Brazil, where the hacktivists concentrated their unwelcome attentions. Other points of interest involve Pakistan, and US.

Last but not least, this period recorded an unusual number of targeted attacks spotted in the news. The list includes (but is not limited to): the British Government Secure Intranet, an US Hedge Fund, Vietnamese Ministry of Natural Resources and Environment, ICS vendors in US and Europe and a Government Agency in Taiwan.

As usual, if you want to have an idea of how fragile our data are inside the cyberspace, have a look at the timelines of the main Cyber Attacks in 2011, 2012, 2013 and now 2014 (regularly updated). You may also want to have a look at the Cyber Attack Statistics, and follow @paulsparrows on Twitter for the latest updates.

Also, feel free to submit remarkable incidents that in your opinion deserve to be included in the timelines (and charts).

16-31 June 2014 Cyber Attacks Timeline rev2

(more…)

Continue Reading16-31 June 2014 Cyber Attacks Timeline

1-15 July 2014 Cyber Attacks Timeline

It’s time for the first cyber attacks timeline of July reporting the main cyber events happened (or discovered) during the first half of the month.

In a short summary: if even the number of recorded attacks remains moderate, the most important events of this period are related to Cyber Espionage: eight sophisticated campaigns have been discovered, a number remarkably high for this category.

On the cyber crime front, the most important event of this period is undoubtedly the massive attacks against Boleto, the Brazilian payment system ($ 3.5 billion is the amount of money stolen by the criminals), but also the purported leak of CNET’s database (subsequently offered on sale by the criminals at the symbolic price of 1 Bitcoin) deserves a special mention. Also the African continent is on the spot with the discovery of a repeated fraud against a couple of Nigerian banks.

Nothing particularly remarkable by hacktivists, with the partial exception of the Syrian Electronic Army, back with the Specialty of the House (the account hijacking, this time against the official Twitter account of the Israel Defence Force). The hacktivistic landscape also offered some attacks against Israel, related to the events in Gaza. Nothing particularly relevant so far, but everything suggests that the number of these attacks will dramatically increase in the next timeline.

If you want to have an idea of how fragile our electronic identity is inside the cyberspace, have a look at the timelines of the main Cyber Attacks in 2011, 2012, 2013 and now 2014 (regularly updated). You may also want to have a look at the Cyber Attack Statistics, and follow @paulsparrows on Twitter for the latest updates.

Also, feel free to submit remarkable incidents that in your opinion deserve to be included in the timelines (and charts).

1-15 July 2014 Cyber Attacks Timeline (more…)

Continue Reading1-15 July 2014 Cyber Attacks Timeline

16-31 July 2014 Cyber Attacks Timeline

July is gone and hence it’s time, as usual, to summarize the main cyber events happened in the second half of this month (Part I here).

For a strange coincidence this month has shown an unusual number of breaches dating back to several years ago (2010-2012) and reported only now: Catch of The Day, Think W3 Limited, Paddy Power and Lasko are the organizations affected.

Looking quickly at Cyber Crime, these two weeks have brought the breach to The Wall Street Journal (by W0rm the same author of the breach to CNET), the disclosure of a failed attempt to disrupt the Nasdaq in 2010, a breach to the website of the European Central Bank, an extensive attack aimed to compromise the Tor Infrastructure, and, last bunt not least, the DHS advisory related to Backokff, a PoS Malware already compromising 600 organizations throughout the U.S.

Moving to Cyber Espionage, this period will be remembered for the Canadian allegations against China, related to a cyber attack against The National Research Council and the possible compromising three Israeli defense contractors responsible for building the “Iron Dome” missile shield program.

Israel was even under the radar of the Hacktivists, who concentrated there their efforts in support of the #OpSaveGaza operation.

If you want to have an idea of how fragile our electronic identity is inside the cyberspace, have a look at the timelines of the main Cyber Attacks in 2011, 2012, 2013 and now 2014 (regularly updated). You may also want to have a look at the Cyber Attack Statistics, and follow @paulsparrows on Twitter for the latest updates.

Also, feel free to submit remarkable incidents that in your opinion deserve to be included in the timelines (and charts).

16-31 July 2014 Cyber Attacks Timeline (more…)

Continue Reading16-31 July 2014 Cyber Attacks Timeline

1-15 August 2014 Cyber Attacks Timeline

This month of August will be probably remembered for the massive cache of 1.2 million of password scooped up by the Russian gang Cyber Vor, undoubtedly the most important event that overshadowed all the other activity recorded in these dog days.

Besides this remarkable fact, the Cyber Crime chronicles report, among others, an unprecedented attack technique, aimed to hijack ISP traffic to steal bitcoins, the breach to SuperValu, and the compromising of 60,000 staffers who participated in Tennessee health screening program.

Cyber Espionage is still in the spotlight, with the breach to USIS (United States Investigation Services), the discovery of the Turla campaign, and also of a similar campaign targeted specifically to Ukraine.

Turning the attention to hacktivism: Ukraine, Israel and the US (following the events of St. Louis) have been the hottest frontlines, even if the most important event is perhaps the attack against Gamma International, the company behind of the infamous FinFinsher spyware.

If you want to have an idea of how fragile our electronic identity is inside the cyberspace, have a look at the timelines of the main Cyber Attacks in 2011, 2012, 2013 and now 2014 (regularly updated). You may also want to have a look at the Cyber Attack Statistics, and follow @paulsparrows on Twitter for the latest updates.

Also, feel free to submit remarkable incidents that in your opinion deserve to be included in the timelines (and charts).

1-15 August 2014 Cyber Attacks Timeline (more…)

Continue Reading1-15 August 2014 Cyber Attacks Timeline

1-15 October 2014 Cyber Attacks Timeline

Here we go with the first timeline of the main Cyber Attacks happened in October (according to my personal evaluation metric).

Two weeks very active from an information security perspective. The list of attacks is quite long and heterogeneous, with massive breaches (The Snappening and a list of nearly 7.000.000 compromised accounts used to brute-force Dropbox), a rich list of cyber crime and cyber espionage campaigns, a renewed burst of the cyber war between India and Pakistan, and a couple of operations orchestrated by hacktivists.

Digging into Cyber Crime, besides the two above quoted events, we find the Mac.BackDoor.iWorm, a widespread botnet targeting OS X, and trapping 17,000 devices. The list continues with a purported attack against Yahoo, initially believed to be orchestrated exploiting the infamous Shellshock vulnerability, the ATM malware Tyupkin, supposed to have been used for stealing millions of bucks from 50 ATMs in Eastern Europe and Russia, a breach against Kmart, and, last but not least, other two (and a half) waves of leaked photos from the Snappening.

Scrolling down the Cyber Espionage events, we cannot help but notice a similar abundance of operations with a widespread usage of 0-day vulnerabilities. Just to mention several names: Sandworm, Hurricane Panda, and even an old acquaintance like Nitro.

India and Pakistan were very busy in the Cyber Space, with  defacements and leaks against a wide range of mutual targets like also the Anonymous, who kicked off #OPHK, against China and in support of Hong Kong protesters.

If you want to have an idea of how fragile our electronic identity is inside the cyberspace, have a look at the timelines of the main Cyber Attacks in 2011, 2012, 2013 and now 2014 (regularly updated). You may also want to have a look at the Cyber Attack Statistics, and follow @paulsparrows on Twitter for the latest updates.

Also, feel free to submit remarkable incidents that in your opinion deserve to be included in the timelines (and charts).

1-15 October 2014 Cyber Attacks Timeline (more…)

Continue Reading1-15 October 2014 Cyber Attacks Timeline

16-31 October 2014 Cyber Attacks Timeline

It’s time for the second timeline of October (Part I here) covering the main cyber attacks between the 16th and 31st: yet another consistent list confirming the growing trend of the last period.

In particular, in these two weeks the most important events have been spotted inside Cyber Espionage, whose chronicles report, among other, a state-sponsored attack to an unclassified network of the White House, a relevant number of operations (APT 28, Operation Pawn Storm, Operation SMN, Operation DeathClick, a tail of the infamous Sandworm), and even a man-in-the-middle attack against Chinese iCloud users.

Cybercrime is also on a roll: the trail of attacks against retailers seems unstoppable (Staples is the latest victim), but chronicles also report a massive breach in South Korea, involving Pandora TV and a gigantic SQL Injection attack, driven by CVE-2014-3704, against every unpatched website running Drupal, existing on this desperate planet. There is also space for a little bit of irony, as in case of Sourcebooks, the publisher hacked few days before releasing the latest book of Brian Krebs.

Israel and Ukraine keep on being two hot fronts for Hacktivism, whereas India is again the cradle of  cyberwar, many events event in this months (despite limited to skirmishes involving defacements of governmental and military websites).

If you want to have an idea of how fragile our electronic identity is inside the cyberspace, have a look at the timelines of the main Cyber Attacks in 2011, 2012, 2013 and now 2014 (regularly updated). You may also want to have a look at the Cyber Attack Statistics, and follow @paulsparrows on Twitter for the latest updates.

Also, feel free to submit remarkable incidents that in your opinion deserve to be included in the timelines (and charts).

16-31 October 2014 Cyber Attacks Timeline (more…)

Continue Reading16-31 October 2014 Cyber Attacks Timeline

Fortune 500 Cyber Attacks Timeline

For the Infosec professionals, this troubled 2014 will be remembered for the trail of gigantic breaches unleashed nearly exactly one year ago, when the real outcome of the infamous Target breach became to emerge. The real extent of the breach was yet to be known, like also the fact that it would not have been an isolated case, but just the beginning of a nightmare.

However this is not the only example of a Fortune 500 company deeply hit, and thanks to a very smart hint by @bufferzone, I took the opportunity to collect in this timeline all the main cyber incidents involving Fortune 500 and Fortune 500 Global companies since 2011 to nowadays.

The adopted selection criteria take into considerations only incidents involving a direct impact on end users, so defacements have not been taken into consideration.

Fortune 500 Global companies are characterized by a blank value in the Rank column, whereas Fortune 500 companies are characterized by a red value. Also, when possible I inserted both values if the targeted company belongs to both charts and, in those cases in which a subsidiary company has been targeted, I have obviously inserted the rank of the parent company.

Fortune 500 Cyber Attacks TImeline (more…)

Continue ReadingFortune 500 Cyber Attacks Timeline

1-15 November 2013 Cyber Attacks Timeline

It’s time for the summary of the main cyber attacks occurred in the first half of November and reported on the news.

These fifteen days have been particularly troubled from an information security perspective, having left to the records several remarkable breaches: LoyaltyBuild, affecting potentially 1.12 million individuals, CorporateCarOnline.com (850,000 individuals), MacRumors (850,000 individuals) and, last but not least, vBulletin (860,000 users affected). A damage report which appears really devastating.

But even hacktivists have been particularly active: several operations have been carried on by the Anonymous all over the world (Italy, UK, Singapore, Japan, Philippines and Ukraine). One in particular (by Indonesian hacktivists against Australian targets) has apparently created a fracture inside the collective.

Last but not least, the chronicles report the latest hack of the Syrian Electronic Army against VICE and a new wave of attacks of Pakistani hackers against Indian targets.

As usual, if you want to have an idea of how fragile our data are inside the cyberspace, have a look at the timelines of the main Cyber Attacks in 2011, 2012 and now 2013 (regularly updated). You may also want to have a look at the Cyber Attack Statistics, and follow @paulsparrows on Twitter for the latest updates.

Also, feel free to submit remarkable incidents that in your opinion deserve to be included in the timelines (and charts).1-15 November 2013 Cyber Attacks Timeline

(more…)

Continue Reading1-15 November 2013 Cyber Attacks Timeline

1-15 December 2013 Cyber Attacks Timeline

Maybe hackers are feeling the Christmas atmosphere since this first half of December has recorded a minor number of attacks in comparison with the previous months. However considering merely the number of attacks to evaluate the cyber landscape could bring to wrong conclusions since, even if in absolute terms the number of attacks has experienced a decrease, in several cases the amount of affected users has been really considerable.

This is the case, for instance, of the 20 million of records leaked in China (and found on WeChat) or the 2.4 million of students and employees of Maricopa Community College compromised in an Aprl Security Breach.

It is really curious to notice that in (too) many cases the breaches have been notified several months later. As also happened for JP Morgan Chase, who also had 456,000 owners of prepaid cash cards compromised in July and notified only in December.

Concerning Cyber Espionage, chronicles report of an alleged Chinese Cyber Attack during the 2013 G8 Summit in Russia, while hacktivists were constantly active in Ukraine, Turkey, India, Syria (indirectly) and, a new Entry for December, Angola.

As usual, if you want to have an idea of how fragile our data are inside the cyberspace, have a look at the timelines of the main Cyber Attacks in 2011, 2012 and now 2013 (regularly updated). You may also want to have a look at the Cyber Attack Statistics, and follow @paulsparrows on Twitter for the latest updates.

Also, feel free to submit remarkable incidents that in your opinion deserve to be included in the timelines (and charts).

1-15 December 2013 Cyber Attacks Timeline (more…)

Continue Reading1-15 December 2013 Cyber Attacks Timeline