The official Website of Bernd Pulch. Since 2009 providing critical insights and political Satire on lawfare, media control, and political reality. Avoid fake sites.
Become a Patron! True Information is the most valuable resource and we ask you to give back.
The U.S. should brace itself for more attacks like one on the U.S. Office of Personnel Managementโin which millions of sensitive government records were stolen, the director of the National Security Agency warned on Wednesday
The U.S. government last week said that two cyberattacks on the agency compromised more than 21 million Social Security numbers, 1.1 million fingerprint records, and 19.7 million forms with data that could include a personโs mental-health history.
โI donโt expect this to be a one-off,โ said Navy Adm. Mike Rogers, who heads the NSA and the U.S. militaryโs Cyber Command.
The incident is causing the government to review cybersecurity policies, he added. โAs we are working through the aftermath of OPM,โ Adm. Rogers said one of the questions is โwhat is the right vision for the way forward in how we are going to deal with things like this.โ
Cyber Command, though responsible for protecting Defense Department networks, wasn’t charged with defending the Office of Personnel Managementโs system, he added.
Director of National Intelligence James Clapper last month said China is suspected to be behind the hack.
Adm. Rogers likened the hacking of U.S. government records to last yearโs attack on Sony Pictures Entertainment, which revealed sensitive company information. He said such events required a governments and companies to step back and review procedures.
Adm. Rogers was speaking at the London Stock Exchange as part of an outreach effort to the financial sector to raise awareness of cybersecurity threats.
โWe are in a world now where, despite your best efforts, you must prepare and assume that you will be penetrated,โ he told the group. โIt is not about if you will be penetrated, but when,โ he said.
David Omand, the former head of the U.K. Government Communications Headquarters, said at the event that the average cost of a breach on U.S. companies is around $20 million. U.K. figures suggest a lower cost, though he said those may be too conservative.
Adm. Rogers said companies and the government needed to work together to protect networks. โCyber to me is the ultimate partnership. There is no single entity out there that is going to say: โdonโt worry, Iโve got this.โโ
Become a Patron! True Information is the most valuable resource and we ask you to give back.
Malicious cyber actors are using advanced search techniques, referred to as โGoogle dorking,โ to locate information that organizations may not have intended to be discoverable by the public or to find website vulnerabilities for use in subsequent cyber attacks. โGoogle dorkingโ has become the acknowledged term for this malicious activity, but it applies to any search engine with advanced search capabilities. By searching for specific file types and keywords, malicious cyber actors can locate information such as usernames and passwords, e-mail lists, sensitive documents, bank account details, and website vulnerabilities. For example, a simple โoperator:keywordโ syntax, such as โfiletype:xls intext:username,โ in the standard search box would retrieve Excel spreadsheets containing usernames. Additionally, freely available online tools can run automated scans using multiple dork queries.
ยป (U) In October 2013, unidentified attackers used Google dorking to find websites running vulnerable versions of a proprietary Internet message board software product, according to security researchers. After searching for vulnerable software identifiers, the attackers compromised 35,000 websites and were able to create new administrator accounts.
ยป (U) In August 2011, unidentified actors used Google dorking to locate a vulnerable File Transfer Protocol server at an identified US university and compromised the personally identifiable information of approximately 43,000 faculty, staff, students, and alumni, according to an information technology security firm.
ยป (U) The Diggity Project is a free online tool suite that enables users to automate Google dork queries. It contains both offensive and defensive tools and over 1,600 pre-made dork queries that leverage advanced search operators.
(U) Suggested measures for website administrators to protect sensitive information include:
ยป (U//FOUO) Minimize putting sensitive information on the web. If you must put sensitive information on the web, ensure it is password protected and encrypted.
ยป (U//FOUO) Use tools such as the Google Hacking Database, found at http://www.exploit-db.com/google-dorks, to run pre-made dork queries to find discoverable proprietary information and website vulnerabilities.
ยป (U//FOUO) Ensure sensitive websites are not indexed in search engines. GoogleUSPER provides webmaster tools to remove entire sites, individual URLs, cached copies, and directories from Googleโs index. These can be found at: https://www.google.com/webmasters/tools/ home?hl=en.
ยป (U//FOUO) Use the robots.txt file to prevent search engines from indexing individual sites, and place it in the top-level directory of the web server.
ยป (U//FOUO) Test your website using a web vulnerability scanner.
Become a Patron! True Information is the most valuable resource and we ask you to give back.
The email attachment looked like a brochure for a yoga studio in Toulouse, France, the center of the European aerospace industry. But once it was opened, it allowed hackers to sidestep their victimโs network security and steal closely guarded satellite technology.
The fake yoga brochure was one of many clever come-ons used by a stealth Chinese military unit for hacking, said researchers at CrowdStrike, an Irvine, Calif., security company. Their targets were the networks of European, American and Japanese government entities, military contractors and research companies in the space and satellite industry, systematically broken into for seven years.
Just weeks after the Justice Department indicted five members of the Chinese army, accusing them of online attacks on United States corporations, a new report from CrowdStrike, released on Monday, offers more evidence of the breadth and ambition of Chinaโs campaign to steal trade and military secrets from foreign victims.
This 12-story building on the outskirts of Shanghai is the headquarters of Unit 61398 of the Peopleโs Liberation Army. Chinaโs defense ministry has denied that it is responsible for initiating digital attacks.
The report, parts of which The New York Times was able to corroborate independently, ties attacks against dozens of public and private sector organizations back to a group of Shanghai-based hackers whom CrowdStrike called Putter Panda because they often targeted golf-playing conference attendees. The National Security Agency and its partners have identified the hackers as Unit 61486, according to interviews with a half-dozen current and former American officials.
13 April 2014 Google Earth31ยฐ17’16.42″ N 121ยฐ27’17.56″ E
You must be logged in to post a comment.