June has been a constant stream of news about hacks, attacks and discovered vulnerabilities. By mid-June there were enough stories to fill up our Hack Hall of Shame top ten. Many breaches will probably leave ripples in the cyber security industry, most notable amongst them are the breach at the Office of People Management in the US and the attack on Kaspersky’s own network.
This month also saw a company going out of business because of an attack. Code Spaces, a seven-year-old SaaS provider was forced out of business after an attacker made his way into the company’s Amazon Web Services’ control panel and demanded a ransom to give back control. When the company didn’t comply, the attacker started deleting resources and by the time Code Spaces regained access, they were left with nothing.
Countdown with us the top 10 hacks, attacks, bugs and vulnerabilities that happened in the month of June.
Millions of US government employees hit by breach
Probably one of the worst breaches to date has been the one the Office of Personnel Management in the US suffered this month. Millions of US government employees, both past and present, have been exposed in the breach. The OPM discovered the breach back in April and is currently in the process of informing every individual affected in order to offer free identity theft protection services.
Stealth attack on Kaspersky
Duqu is back and it’s meaner than ever before. This month Kaspersky released information about their internal networks where at the end of an advanced attack which exploited zero-day vulnerabilities in order to infiltrate and spy. The threat was named Duqu 2.0 and was discovered during a security sweep. Kaspersky customers are safe as neither products nor services were compromised in this attack.
Yet another shock this month was the LastPass breach mainly because the reason many of us use password managers is to increase our security online. In an email to its customers, LastPass revealed that email addresses and encrypted master passwords were compromised in a breach and urged its users to change their master password used to access the account.
A bad month for Japan
June wasn’t a good month for the Japanese either. On June 3, 1.25 million records from the Japan Pension Services where leaked following a phishing attack which happened after an employee opened an email containing a virus which scraped all names, pension account numbers, date of birth and addresses. Then, reports of an attack on the Japanese oil association was reported. According to SC Magazine numerous PCs at Japan’s Petroleum Association became infected with an unknown virus, however, no data has been leaked so far.
A deadly zero-day flaw in Apple iOS and OS X was revealed by six university researchers from the University of Indiana on June 17 who claimed they managed to “crack Apple’s password-storing keychain, break app sandboxes, and bypass its App Store security checks.” Malware was uploaded to the App Store which when installed would raid the KeyChain and third party apps. The exploit can be demonstrated in the video below.
The breach on Germany’s lower house of Parliament was reported last month and said to have cost millions but this month Der Spiegel reported that the cyber-attack might still be active and that the attackers were still receiving information from the ‘trojan’ attacks.
Polish airlines grounded
On June 21, LOT, Poland’s national airline found itself at the end of an “IT attack” which grounded 10 flights with another 12 being delayed. LOT explained that the attack was on the ground computer systems at Warsaw airports and at no point was the safety of their passengers at risk.
US army website defaced
Army.mil was taken down at the start of the month after it was defaced by the Syrian Electronic Army. The website is a US military shop and the take down caused many red faces in Washington especially since this attack came only a few months after YouTube and Twitter accounts of the US Central Command had to be closed after even more cyber vandalism.
Microsoft’s anti-surveillance site hacked
DigitialConstitution.com, a website by Microsoft dedicated to opposing US surveillance, launched back in 2013 was hacked on June 17. Text and images where injected into the site probably exploiting a vulnerability in an older WordPress version.
Canadian government websites attacked
The month of June also saw some hacktivism on the part of Anonymous who took responsibility for the DDOS attack which shut down of several government websites on June 17. Anonymous said this attack was to protest the much criticized anti-terror law that gives Canada’s spy agency more power and is considered to encroach on civil liberties.