News briefs: Epsilon breached, Google settles with FTC
»Hackers breached RSA's systems and stole information related to its two-factor authentication products. RSA President Art Coviello (left) said information obtained by the hackers may teach them how to circumvent RSA's SecurID products. The company urged customers to be more vigilant about security in light of the incident, but provided few details about the attack or how its SecurID products are affected.
»Experts expect a rise in spear phishing attacks after Epsilon, the world's largest “permission-based” email marketing provider, revealed that hackers gained unauthorized entry to its email system to steal customer data. Well-known banks and retailers that use Epsilon – including Best Buy, Capital One and Disney – notified customers that hackers stole their email addresses.
»More than 1.5 million web pages were infected via SQL injection to serve rogue anti-virus programs, known as scareware, according to security firm Websense. The sites were injected with code that directs victims to a website called Liza Moon, which automatically redirects users to a notorious site serving fake anti-virus.
»The Federal Trade Commission ordered Google to fix its privacy practices following backlash resulting from the launch of its Buzz social networking service. The FTC ordered Google to implement a privacy program. In addition, Google must conduct independent privacy audits every two years for the next 20 years and is prohibited from making “future privacy misrepresentations.”
»Samsung's reputation was cleared after several recent reports wrongly accused the company of selling laptops containing keylogging software capable of recording anything a user typed. The misunderstanding began after security researcher Mohamed Hassan said he purchased two brand new Samsung laptops that were infected with a commercial keylogger called “StarLogger.” Turns out, Hassan used an anti-virus program produced by GFI Software called VIPRE that, during a scan of the laptop, mistook a legitimate folder for the keylogging software.
»Comodo, a Jersey City, N.J.-based company that issues digital SSL certificates used by websites to validate their identity to visitors, revealed that an attacker compromised one of the company's European resellers and issued nine fraudulent digital certificates for high-profile sites like Google, Yahoo, Skype and Microsoft's Hotmail. Comodo said the attack was likely state-sponsored, but an Iranian hacker took responsibility for the attack and claimed no political agenda.»The number of cyber incidents affecting U.S. federal agencies shot up 39 percent in 2010, according to a report from the Office of Management and Budget, but experts said the increase is partly a reflection of improved discovery capabilities within government. The feds were the target of approximately 41,776 reported attacks in 2010, up from 30,000 the year before. Alan Paller, director of research at the SANS Institute, said federal departments have been employing in their security operations centers more highly skilled workers who are doing a better job of discovering attacks.
»Hackers have compromised Oracle's MySQL.com customer website via SQL injection. Two Romanian hackers have taken responsibility for the attack and said they exploited an SQL injection flaw to break into the web servers hosting MySQL.com, a website for the open source database product. The hackers posted information extracted from MySQL, including the cracked passwords of users. Oracle said it is investigating.
» Erratum: We failed to list Rich Baich, principal at Deloitte & Touche LLP, as a judge for the SC Awards 2011. We apologize for the oversight.