HOME     MENU     SEARCH     NEWSLETTER    
NEWS & INFORMATION FOR TECHNOLOGY PURCHASERS. UPDATED ABOUT A MINUTE AGO.
You are here: Home / Hardware / Hacker Tries To Sell Access to BBC
Druva Endpoint Backup:
Enterprises Realize Simple Secure Backup with Druva
www.druva.com
Russian Hacker Tries To Sell Access to BBC Server
Russian Hacker Tries To Sell Access to BBC Server
By Jennifer LeClaire / NewsFactor Network Like this on Facebook Tweet this Link thison Linkedin Link this on Google Plus
PUBLISHED:
DECEMBER
30
2013



Reports of a Russian hacker who stealthily took over a BBC computer server before Christmas are circulating far and wide. Hold Security first shared details of the hack with Reuters.

Alex Holden, chief information security officer at Hold Security, told Reuters that his "researchers observed a notorious Russian hacker known by the monikers 'HASH' and 'Rev0lver,' attempting to sell access to the BBC server on Dec. 25."

According to the Reuters report, Holden said "HASH" sought to convince high-profile hackers that he had infiltrated the site by showing them files that could only be accessed by somebody who really controlled it, Holden said, noting that his researchers have found no evidence the conversations led to a deal or that data was stolen from the BBC.

Rehashing 2013's Media Hacks

BBC issued a public statement, stressing, "We do not comment on security issues." Justin Clarke, a principal consultant for the cybersecurity firm Cylance, told Reuters that while "HASH" was only offering access to an obscure FTP server not a Web server, some buyers might see it as a steppingstone to more prized assets within the BBC.

"Accessing that server establishes a foothold within BBC's network which may allow an attacker to pivot and gain further access to internal BBC resources," he said.

This is far from the first time hackers have broken into media servers. Earlier in December, hackers hit The Washington Post for at least the third time in the past three years. The Post was more forthcoming than the BBC, disclosing that the extent of the data loss is not clear, but employees had been instructed to change their user names and passwords -- even though they were stored in encrypted form -- based on the assumption that they may have been compromised.

In August, the Syrian Electronic Army hit The New York Times, Twitter and its image server Twimg, among other sites, with a DNS attack. And earlier this year, the SEA targeted The Financial Times, The Guardian and The Associated Press, as well as The Washington Post.

Expect More Attacks in 2014

What can we expect in 2014? David Bills, chief reliability strategist at Microsoft's Trustworthy Computing, said online services across the industry and around the world have experienced service disruptions during the past year -- and he expects this trend to continue.

"Cloud service providers adopting contemporary resilience-enhancing engineering practices like failure mode and effects analysis and programmatic fault injection can help to reduce this trend," he said. "The adoption of practices such as these will help to effectively address the persistent reliability-related device failures, imperfections in software being triggered by environmental change and mistakes made by human beings while administering those services."

Mike Reavey, general manager of Operational Security Assurance at Microsoft's Trustworthy Computing, said as more and more organizations across the industry embrace secure development tools like Microsoft's Security Development Lifecycle, and operations teams mature their processes to become more security-centric with methodologies such as Operational Security Assurance for online services, attackers will be left trying to exploit the seams between development and operations.

"We'll see operational security champions build tighter connections with their developer counterparts. Threat modeling will grow to a broader, more systems-based approach," Reavey said. "And methodologies will become more repeatable and rigorous, borrowing from tried-and-true processes in development such as application threat modeling, and growing similar muscle in operations using continuous monitoring and operational reviews.

"While attackers are already trying to exploit these gaps, many of the pieces for the defense's playbook exist, and we'll see them come together to increase the challenge for attackers."

Tell Us What You Think
Comment:

Name:

Like Us on FacebookFollow Us on Twitter
TOP STORIES NOW
MAY INTEREST YOU
Barium Ferrite Is The Future Of Tape: Barium Ferrite (BaFe) offers greater capacity, superior performance, and longer archival life compared to legacy metal particle (MP) tape. Click here to learn more.
MORE IN HARDWARE
Product Information and Resources for Technology You Can Use To Boost Your Business

NETWORK SECURITY SPOTLIGHT
Using Internet-connected devices without strong passwords is inherently risky, as illustrated by reports that a Russian Web site is showing live footage from thousands of people's webcams.

ENTERPRISE HARDWARE SPOTLIGHT
Doctor Who had K-9, the robot dog that accompanied him on adventures through space. Now, Mountain View has K5, a 5-foot-tall, 300-pound robot security guard patrolling in the Bay Area.

MOBILE TECHNOLOGY SPOTLIGHT
To better its customer service, Comcast is pulling out at least some of the stops. The cable giant has launched an app so you can track the cable guy in real time. It's designed to ease customer frustration.

© Copyright 2014 NewsFactor Network, Inc. All rights reserved. Member of Accuserve Ad Network.