More Retail Breach Details

We are about to release some details on another retail breach. It seems it just keeps getting worse and worse. We are trying to contact these folks but if they don't respond we will just post the information here.

chaffey.edu Breached

A database containing the personal contact information at chaffey.edu was reported today. It appears through our research that the information is legitimate.

In addition to name, phone number the breach also indicates if the employee is full or part time, departments and additional information that should not have been posted.

It's interesting watching as these organizations fall victim to SQLi attacks.

Trinity College host being used as C2 by credential stealing malware (157.252.245.49)

We notified Trinity College of the issue and have not gotten a response.

US Government and Military Hacked by ISIS?

Absolutely. It's the same information I posted yesterday.

See this article - Click Here

Now we have seen information being leaked and cannot name individual companies at this time but they are getting in through Government contractors. Information has been shared to confirm that they have actively stolen information on communications facilities and may have used that information in farther attacks. We have 6 days left in our notification wait period and then we will post the information we received in our Threat Intelligence Platform to our subscribers.

Government contracting companies should start looking through their systems and get real security vendors to help you protect your networks.

Here we go again...

BREACH: habbo.nl

The system at www.habbo.nl has been compromised and user information has since been posted to several forums. The information on this incident is available in the SLC Security Services LLC threat intelligence platform.

Large Telecommunications Company Appears to have been Breached

SLC Security researchers have located information indicating that a large telecommunications company servicing Government clients has had a database compromised. We are in the process of notifying the affected company and will wait our standard 7 days until we release the information that we have located.

Notifications Sent: 8-11-2015

After farther review it appears as though the information found may also impact a large Government contractor. Additional research is currently being performed but it appears as though the leaked information is confirmed based on OSINT research that was conducted earlier.

Related Article: http://www.nbcnews.com/storyline/isis-terror/isis-group-claims-have-hacked-information-military-personnel-n408236

8-12-2015: As of 8-12-2015 none of the notified entities have responded to our notification. We will wait 6 more days before posting the entities involved giving them time to perform remediation on any issues they may have discovered as part of this incident. 

8-19-2015: None of the notified entities have responded. SLC Security Services LLC has posted information concerning the release of proprietary information from Zayo concerning facilities in Northern Virginia. to our Threat Intelligence Platform. 

For a trial of of our threat intelligence platform please visit www.slcsecurity.com. 

OMB Credit Monitoring Failure

It has come to our attention that many of the affected individuals have not been able to sign up for credit monitoring. As part of the CSID program that was setup after the OMB breach potentially thousands of former contractors and employees are not being covered or have not received a PIN number to register for credit monitoring. In addition the system is a best effort attempt to reach affected individuals.

Several of our staff members who are active duty and reserve, employees and contractors have not been notified even though the addresses last used on SF-86's are up to date.

This is troubling in that unless you are still contracting they seem to have forgotten or have failed to notify said individuals.

Some people that have never had clearances or have never even applied for a clearance have been notified and are also scratching their heads.

One individual that has held at least a secret clearance since 1992 through this year has not received a notification. The question then becomes how are they determining if your information was stolen or if you are affected. Based on the provided time frame put out by the media this individual should have been affected since not only did they hold a DOD clearance but were also a former Federal Employee as well as active duty military and subsequently an Active Ready Reservist during the times indicated by OMB.

It seems as though OMB has turned their backs on some people either in an attempt to save money or because they simply don't care. This looks all too familiar to how private industry has handled breaches and is quite alarming.

Potentially Breached Entities (From Sensor Data) - 7-23-2015 6:44PM EST

The following host have been detected as being potentially breached based on data from SLC Security owned and operated sensors. We have decided that we would start publishing a daily list to help these organizations get their network under control. While we believe these host to be breached they may also be involved in hacking attempts on other entities or may be used by hackers as a jump point to conduct other attacks. The following list are the bad entities for the last 24 hours. Our volunteers have detected the following attackers:

• doa.la.gov - Confirmed breached
• bonescan.bidmc.harvard.edu - Confirmed breached

We have previously reported on Harvard and now they are serving up APT29 malware samples. I would seriously hope they start to contain their incidents or we will be forced to start blocking them via DNS at client sites. 

UPDATE:
It appears as though doa.la.gov has removed the infected file and bonescan.bidmc.harvard.edu has been removed from DNS records so it's not longer accessible. 

BREACH: Univ of Michigan 2nd Notification - UPDATED

Pay attention because we are seeing traffic from the Univ of Michigan as well as Horizon's Church in Michigan. They still appear to have issues. We previously posted that ISIS was cyber targetting Univ of Michigan and this host we are seeing has had activity for most of the month of June.

Host: 199.101.99.146

Analyst Notes: A quick review shows that this entity is on a number of blacklist. In addition SANS distributed sensors have seen 275 incidents of activity from this host. SLC Security has logged 1104 events in the last 7 days from this host. 

Harvard Breach - What did we see? - UPDATED

So it has been reported by news media this evening that Harvard has once again fallen to hackers. Security researcher and advocate databreaches.net contacted us to pass along the news article.

http://www.thecrimson.com/article/2015/7/2/harvard-it-security-breach/

So what did we know and when did we know it?

SLC Security Services LLC started seeing Dyre emails flowing through our sensor network on 21 June 2015. We posted a message about it on the Vulnerable Disclosures Blog on the 24th of June when we noticed the activity did not stop (which is staffed by our cybersecurity volunteers). Below is a screenshot of our original message:

Our sensors started seeing millions of email messages containing Dyre malware being sent out to many other systems.

This traffic started on the 21st of June late in the evening. On the 22nd we saw several dumps of Harvard email addresses on Pastebin and additional data on the 23rd and 24th. By the 25th the systems were scanning Internet host and attempting to hack into other systems (which we monitor and maintain).


Hopefully they can find a reputable security firm to secure their infrastructure. This has been at least 3 breaches since we really started paying attention to Harvard.

To be fair to all monitoring the situation Crowdstrike detected the activity on the 22nd of June as well and attributed the attack to Gothic Panda actors. Whether that is in fact the case remains to be seen.

Media Coverage:
https://threatpost.com/june-harvard-breach-hit-multiple-schools/113601

Upon researching it appears as though there may have been as many as 13 schools affected. In addition the personal login information from third party accounts may have also been compromised as we are seeing indications that some students personal email accounts have also been leaked in the same time frame. - Additional research performed on historical data on 3 July 2015.

Don't fall victim to breaches. Email our SOC soc(a-t)slcsecurity(dot)com and request a free 30 day trial of our threat intelligence platform today. We offer insights into breaches and in many cases we can tell entities are breached before they even notice it. SLC Security Services LLC operates a vast network of Intrusion Detection Sensors on the Internet, private networks and at select Internet Services Providers. For more information on our services visit www.slcsecurity.com today. 

BREACH: Element Vehicle Management Services

Seeing indications that this entity is breached. Information has been posted to the Internet and is already hitting some underground chat services.

BREACH: army.mil breached by Syrian Electronic Army

Reports have been coming in that the Syrian Electronic Army has breached (www.army.mil) and DOD has put out noticed to staff to not access the site. That doesn't matter though because the site has been taken offline by DOD at this hour.

Reference: http://www.newsweek.com/syrian-electronic-army-claims-have-hacked-us-army-website-340874

BREACH: Shop T Wine

We noted usernames and passwords that could be confirmed being leaked today for the Shop T Wine website. The information first appeared in a hacking forum and then appears to have been posted to pastebin. As of the post time the information remains available on pastebin.

BREACH: mSpy Breached

A company linked to mobile phone spy software has become the victim of hacking.

See Kreb's report here.

BREACH: Ryanair Hacked

Low-cost airline Ryanir has been the victim of a major banking hack, with more than $5 million stolen from its business account last week, reports City AM. 

The company has reported the crime and asked the Criminal Assets Bureau in Dublin to help it recover the money, which is said to have been transferred electronically to a bank in China. It is also working with authorities in Asia. [...]

Source: We Live Security

BREACH: UC Berkeley Breached Again... Or still depending on your perspective...

We are honestly tired of reporting on this one. We let them know about problems at least twice and I'm pretty sure the folks at databreache's have also notified them. It seems they just can't get things in order...

A look at our database shows they have been compromised for AWHILE:

April 28th 2015, 22:07:28.862 slcsecurity-iocs UC CAMPUS BERKELEY
April 28th 2015, 22:07:28.696 slcsecurity-iocs UC Berkeley
April 28th 2015, 22:06:03.228 slcsecurity-iocs UC CAMPUS BERKELEY
April 28th 2015, 22:06:03.047 slcsecurity-iocs UC Berkeley
April 28th 2015, 22:05:45.521 slcsecurity-iocs UC CAMPUS BERKELEY
April 28th 2015, 22:05:45.315 slcsecurity-iocs UC Berkeley
April 25th 2015, 21:12:28.252 slcsecurity-iocs UC CAMPUS BERKELEY
April 25th 2015, 21:12:27.279 slcsecurity-iocs UC Berkeley
April 25th 2015, 21:09:34.675 slcsecurity-iocs UC CAMPUS BERKELEY
April 25th 2015, 21:09:34.501 slcsecurity-iocs UC Berkeley
April 25th 2015, 21:08:00.276 slcsecurity-iocs UC CAMPUS BERKELEY
April 25th 2015, 21:08:00.102 slcsecurity-iocs UC Berkeley
April 22nd 2015, 19:27:10.387 slcsecurity-iocs UC CAMPUS BERKELEY
April 22nd 2015, 19:27:09.456 slcsecurity-iocs UC Berkeley
April 21st 2015, 03:12:13.399 slcsecurity-iocs UC CAMPUS BERKELEY
April 21st 2015, 03:12:13.094 slcsecurity-iocs UC Berkeley
April 21st 2015, 01:48:49.009 slcsecurity-iocs UC CAMPUS BERKELEY
April 21st 2015, 01:48:48.507 slcsecurity-iocs UC Berkeley
April 20th 2015, 13:28:05.076 slcsecurity-iocs UC CAMPUS BERKELEY
April 20th 2015, 13:28:04.916 slcsecurity-iocs UC Berkeley
April 19th 2015, 17:34:39.514 slcsecurity-iocs UC CAMPUS BERKELEY
April 19th 2015, 17:34:37.859 slcsecurity-iocs UC Berkeley
April 18th 2015, 21:18:27.701 slcsecurity-iocs UC CAMPUS BERKELEY
April 18th 2015, 21:18:27.536 slcsecurity-iocs UC Berkeley
April 18th 2015, 21:18:09.489 slcsecurity-iocs UC CAMPUS BERKELEY
April 18th 2015, 21:18:09.340 slcsecurity-iocs UC Berkeley
April 18th 2015, 21:17:49.376 slcsecurity-iocs UC CAMPUS BERKELEY
April 18th 2015, 21:17:49.216 slcsecurity-iocs UC Berkeley
April 16th 2015, 12:06:35.424 slcsecurity-iocs UC CAMPUS BERKELEY
April 16th 2015, 12:06:35.247 slcsecurity-iocs UC Berkeley
April 16th 2015, 11:58:36.116 slcsecurity-iocs UC CAMPUS BERKELEY
April 16th 2015, 11:58:33.307 slcsecurity-iocs UC Berkeley
April 16th 2015, 01:34:21.163 slcsecurity-iocs UC CAMPUS BERKELEY
April 16th 2015, 01:34:20.078 slcsecurity-iocs UC Berkeley
April 14th 2015, 14:44:45.261 slcsecurity-iocs UC CAMPUS BERKELEY
April 14th 2015, 14:44:44.912 slcsecurity-iocs UC Berkeley
April 13th 2015, 17:27:40.384 slcsecurity-iocs UC CAMPUS BERKELEY
April 13th 2015, 17:27:39.068 slcsecurity-iocs UC Berkeley
April 13th 2015, 17:14:12.002 slcsecurity-iocs UC CAMPUS BERKELEY
April 13th 2015, 17:14:11.830 slcsecurity-iocs UC Berkeley
April 13th 2015, 17:08:50.339 slcsecurity-iocs UC CAMPUS BERKELEY
April 13th 2015, 17:08:49.834 slcsecurity-iocs UC Berkeley
April 13th 2015, 16:58:17.976 slcsecurity-iocs UC CAMPUS BERKELEY
April 13th 2015, 16:58:17.803 slcsecurity-iocs UC Berkeley
April 13th 2015, 16:57:14.625 slcsecurity-iocs UC CAMPUS BERKELEY
April 13th 2015, 16:57:14.390 slcsecurity-iocs UC Berkeley
April 13th 2015, 16:55:54.768 slcsecurity-iocs UC CAMPUS BERKELEY
April 13th 2015, 16:55:54.327 slcsecurity-iocs UC Berkeley
April 13th 2015, 16:50:57.217 slcsecurity-iocs UC CAMPUS BERKELEY
April 13th 2015, 16:50:55.666 slcsecurity-iocs UC Berkeley
April 13th 2015, 16:50:01.878 slcsecurity-iocs UC CAMPUS BERKELEY
April 13th 2015, 16:50:00.428 slcsecurity-iocs UC Berkeley
April 13th 2015, 16:43:28.333 slcsecurity-iocs UC CAMPUS BERKELEY
April 13th 2015, 16:43:28.068 slcsecurity-iocs UC Berkeley

This is the latest incident. Previously activity was seen back in January and February but then they were removed due to cleaning the infected systems. Now they are back in the system again...

We will continue to monitor.

BREACH: Partners Healthcare System

Databreaches.net is reporting that Partners Healthcare System has reported that they have been the target of a phishing campaign. For more information see the original post here.

BREACH: DeCicco & Sons grocery store suffers data breach

A popular New York supermarket chain is reporting that customer payment card information has been compromised. Customers began noticing out of state charges on their credit cards shortly after shopping at the chain.

BREACH: HSBC Finance Notifies Mortgage Customers of Data Breach

HSBC has informed New Hampshire's Attorney General of a compromise of some records of current and former mortgage customers of its HSBC Finance unit. HSBC Finance is a nonbank lender, formerly known as Household Finance, that HSBC bought in 2003. The bank is in the process of winding it down.

SOURCE: http://www.americanbanker.com/news/bank-technology/hsbc-finance-notifies-mortgage-customers-of-data-breach-1073803-1.html

BREACH: Hackers who breached White House network allegedly accessed sensitive data

Russian-government hackers who reportedly breached the White House's computer systems late last year gained access to sensitive information, though US officials said at the time that they hadn't, according to a story published Tuesday by CNN.


Sources:
http://www.cnet.com/news/hackers-who-breached-white-house-network-allegedly-accessed-sensitive-data/