ICT Security-Sécurité PC et Internet

Have you watched a YouTube video lately in a country where English is widely used?

If so, we’re willing to bet that you’ve seen an advert for Grammarly, an online spelling and grammar checker.

In fact, we’ll suggest you’ve seen the Grammarly ad many times, perhaps even very many times – we certainly have.

The ads seem to be working, with the product currently closing in on 1,000,000 installs in Firefox, and already claiming more than 10,000,000 in Chrome.

As the product pitch in the Firefox add-on store explains:

Once you register your new account, you will start to receive weekly emails with personalized insights and performance stats (one of our most popular new features). Working on a large project, an essay, or a blog post? No sweat. You can create and store all of your documents in your new online editor.

In other words, your Grammarly account ends up knowing a lot about you, and holding copies of a lot of what you’ve written.

A security hole in Grammarly could therefore tell crooks much more about you than you’d like them to know.

Learn more / En savoir plus / Mehr erfahren.

https://www.scoop.it/t/securite-pc-et-internet/?&tag=Grammarly

Hacker sollen laut einem Bericht der SZ vertrauliche Daten von Zehntausenden von Schuldnern gestohlen haben. Darunter Krankenakten, Ausweisdaten und Kreditkartenabrechnungen.

Learn more / En savoir plus / Mehr erfahren:

https://www.scoop.it/t/securite-pc-et-internet/?&tag=DATA-BREACHES

An Amazon Web Services (AWS) S3 cloud storage bucket containing information from data analytics firm Alteryx has been found publicly exposed, comprising the personal information of 123 million US households.

The S3 bucked, located at the subdomain "alteryxdownload", was found by Californian cybersecurity firm UpGuard, with its Cyber Risk Team discovering the leak on October 6, 2017.

According to UpGuard, exposed within the repository were datasets belonging to Alteryx partners, consumer credit reporting agency Experian, and the US Census Bureau.

Full datasets for both Experian's ConsumerView marketing database and the 2010 US Census were available.

Learn more / En savoir plus / Mehr erfahren:

https://www.scoop.it/t/securite-pc-et-internet/?&tag=Alteryx

https://www.scoop.it/t/securite-pc-et-internet/?&tag=DATA-BREACHES

Bloomberg reports on what seems to be a security scandal at Uber.

The ride-sharing firm concealed the theft of personal information related to 57 million customers and drivers, and rather than inform the concerned parties "paid hackers $100,000 to delete the data and keep the breach quiet."

The hack which Uber says is said to have happened in October 2016, and included the names, email addresses and phone numbers of 50 million Uber customers across the globe.

Bloomberg has the skinny on how the hack occurred, and it doesn't portray Uber in a good light, being the latest example of careless developers leaving internal login passwords lying around online:

Here’s how the hack went down: Two attackers accessed a private GitHub coding site used by Uber software engineers and then used login credentials they obtained there to access data stored on an Amazon Web Services account that handled computing tasks for the company. From there, the hackers discovered an archive of rider and driver information. Later, they emailed Uber asking for money, according to the company.

Joe Sullivan, Uber's chief security officer (and at one time the main security honcho at Facebook), spearheaded the company's response to the breach alongside one other employee. Both are said to have left their positions at Uber this week.

Learn more / En savoir plus / Mehr erfahren:

https://www.scoop.it/t/securite-pc-et-internet/?&tag=DATA-BREACHES

https://www.scoop.it/t/securite-pc-et-internet/?&tag=Uber

Uber concealed a massive data breach for more than a year, according to a report by Bloomberg.

Hackers stole names, email addresses, and phone numbers of 57 million Uber riders around the world in a breach dating back to October 2016. Data on more than 7 million drivers was also stolen, including over 600,000 drivers' license records.

Trip records, location data, and social security numbers were not stolen in the breach, the company said.

But instead of alerting users of the breach, the company paid the hackers $100,000 to delete the data and to keep details of the breach quiet.

The company confirmed the breach, in a lengthy statement posted on Tuesday.

"As Uber's CEO, it's my job to set our course for the future, which begins with building a company that every Uber employee, partner and customer can be proud of," said Dara Khosrowshahi. "For that to happen, we have to be honest and transparent as we work to repair our past mistakes."

According to Bloomberg, two hackers broke into a private GitHub repo used by Uber software engineers, and were able to gain access to an Amazon Web Services account that handled and controlled tasks by the ride-sharing service. The hackers found a trove of rider and driver data, downloaded it, and reportedly emailed the company demanding money.

Uber has said, however, that individual riders do not need to take "any action," following the announcement.

Learn more / En savoir plus / Mehr erfahren:

https://www.scoop.it/t/securite-pc-et-internet/?&tag=DATA-BREACHES

https://www.scoop.it/t/securite-pc-et-internet/?&tag=Uber

The Wild Neutron hacking group gained access to an internal database Microsoft uses to track software vulnerabilities.
David Bisson reports.

On 17 October 2017, five former employees revealed that at the time of the breach Microsoft raised a number of internal alarms signaling that hackers had compromised the database it uses to track patches.

The attack has been blamed on Wild Neutron, a sophisticating hacking group which has targeted Apple, Facebook, and a number of other multi-billion dollar companies.

Even so, the former Microsoft workers said the database was poorly protected by just a single password.

Concerned that the hacking group had stolen details on some of its open vulnerabilities for Windows and other software, Microsoft decided to look at other industry breaches and investigate the timing of those event with respect to when the flaws entered its database.

Learn more / En savoir plus / Mehr erfahren:

http://www.scoop.it/t/securite-pc-et-internet/?&tag=DATA-BREACHES

Le cabinet d’audit Deloitte a annoncé avoir été victime d’une attaque informatique ayant visé l’un des serveurs de mails utilisés pour échanger avec ses clients. Plus de 240.000 emails d’employés auraient été potentiellement affectés par l’attaque.

Dans sa communication, la société confirme le piratage annoncé par le Guardian, mais explique que le nombre de victimes est une « fraction » des chiffres avancés dans les médias. Pour l’instant, la portée réelle de l’attaque et le nombre de sociétés touchées restent donc impossibles à déterminer : Deloitte doit sûrement avoir une petite idée, vu que ses équipes enquêtent discrètement sur l’affaire depuis maintenant six mois.

Learn more / En savoir plus / Mehr erfahren:

http://www.scoop.it/t/securite-pc-et-internet/?&tag=DATA-BREACHES

Auf den US-Finanzdienstleister Equifax ist ein Hackerangriff verübt worden, betroffen sind wohl 143 Millionen US-Bürger. In Hunderttausenden Fällen ging es um sensible Daten wie Sozialversicherungs- oder Kreditkartennummern.

Learn more / En savoir plus / Mehr erfahren:

http://www.scoop.it/t/securite-pc-et-internet/?&tag=DATA-BREACHES

Security experts are warning that millions of Verizon customer accounts could still be at risk after a data exposure by an Israeli company working for the phone giant.

Chris Vickery, director of cyber risk research at security firm UpGuard, found as many as 14 million customer records for the past six months on an exposed and unprotected Amazon S3 cloud server in late June.

This sensitive data includes millions of individual customer names, phone numbers, and their account PIN, which we confirmed is all that can be needed by an attacker to access a person's account. That can lead to phone number hijacking and account takeovers, which could allow hackers to break into a person's email and social media accounts protected even by two-factor authentication, according to security experts briefed on the exposure prior to publication.

Verizon said that an investigation determined that "no other external party accessed the data," but did not say how it came to that conclusion. The logic goes that if a security researcher found the data, there's no telling who else might have done.

Learn more / En savoir plus / Mehr erfahren:

http://www.scoop.it/t/securite-pc-et-internet/?&tag=DATA-BREACHES

Details of 77 million students, teachers and parents are thought to have leaked on the web.

Edmodo confirms hackers breached its education platform, stole user data and hashed passwords

Details of 77 million students, teachers and parents are thought to be up for sale on the web.

Last week there were worrying reports that hackers had broken into Edmodo, and stolen the details of some 77 million teachers, students and parents.

Now the popular online education platform has emailed its users, confirming that it has suffered a security breach:

Learn more / En savoir plus / Mehr erfahren:

http://www.scoop.it/t/securite-pc-et-internet/?&tag=DATA-BREACHES

http://www.scoop.it/t/securite-pc-et-internet/?&tag=Edmodo+Insecurity

If you're a member of an online forum, there's a good chance that the site is running a piece of software called vBulletin. The relative ease wit...

Learn more / En savoir plus / Mehr erfahren:

http://www.scoop.it/t/securite-pc-et-internet/?tag=DATA-BREACHES

http://www.scoop.it/t/securite-pc-et-internet/?&tag=forums

Das in Israel ansässige Unternehmen bietet Hacking-Software für Mobiltelefone an. Es hat den erfolgreichen Hackerangriff inzwischen bestätigt. Laut Motherboard fielen den Angreifern 900 GByte mit Kundendaten, Datenbanken und umfangreiche Informationen zur Technik der Cellebrite-Produkte in die Hände.

Learn more / En savoir plus / Mehr erfahren:

http://www.scoop.it/t/securite-pc-et-internet/?tag=DATA-BREACHES

Grammarly has fixed a security bug in its Chrome extension that inadvertently allowed access to a user's account -- including their private documents and data.

Tavis Ormandy, a security researcher at Google's Project Zero who found the "high severity" vulnerability, said the browser extension exposed authentication tokens to all websites.

That means any website can access a user's documents, history, logs, and other data, the bug report said.

"I'm calling this a high severity bug, because it seems like a pretty severe violation of user expectations," said Ormandy, because "users would not expect that visiting a website gives it permission to access documents or data they've typed into other websites."

In proof-of-concept code, he explained how to trigger the bug in four lines of code.

More than 22 million users have installed the grammar-checking extension.

Ormandy filed his bug report Friday, subject to a 90-day disclosure deadline -- as is the industry standard. Grammarly issued an automatic update Monday to fix the issue.

Ormandy has in recent months examined several vulnerable web browser extensions. Earlier this year, he found a remote code execution flaw in the Cisco WebEx Chrome extension, and a data-stealing bug in the popular LastPass password manager.

A spokesperson for Grammarly did not immediately return a request for comment.

Learn more / En savoir plus / Mehr erfahren:

https://www.scoop.it/t/securite-pc-et-internet/?&tag=DATA-BREACHES

Schon wieder hat ein Unternehmen große Mengen persönlicher Daten auf einem öffentlich zugänglichen Amazon-S3-Bucket ins Netz gestellt. Betroffen sind Informationen wie Postadressen, Ausbildung, Kinderzahl und private Finanzinformationen.

Learn more / En savoir plus / Mehr erfahren:

https://www.scoop.it/t/securite-pc-et-internet/?&tag=Alteryx

https://www.scoop.it/t/securite-pc-et-internet/?&tag=DATA-BREACHES

An Amazon AWS server believed to contain files on all of California’s registered voters was left exposed this year due to a misconfigured database, according to researchers at the Kromtech Security Center. The database was later stolen by cybercriminals demanding a ransom only payable in bitcoin.

Learn more / En savoir plus / Mehr erfahren:

https://www.scoop.it/t/securite-pc-et-internet/?&tag=DATA-BREACHES

https://www.scoop.it/t/securite-pc-et-internet/?&tag=RANSOMWARE

Uber sind bereits vor gut einem Jahr Daten von rund 50 Millionen Fahrgästen gestohlen worden. Der Fahrdienst-Vermittler informierte die Öffentlichkeit aber erst am Dienstag über den Vorfall.

Es gehe um Namen, E-Mail-Adressen und Telefonnummern von Nutzern rund um die Welt, erklärte Uber dem Finanzdienst Bloomberg. Außerdem hätten sich die Angreifer auch Zugriff auf Daten von etwa sieben Millionen Uber-Fahrern verschafft.

Es seien aber keine Kreditkarten-Daten oder Informationen zu Fahrten gestohlen worden, betonte die Firma.

Uber räumte nun ein, dass über die Attacke weder Behörden noch Betroffene informiert worden seien. Stattdessen seien den Hackern 100.000 Dollar (rund 85.000 Euro) bezahlt worden, damit sie die gestohlenen Daten vernichten.

„Nichts davon hätte passieren dürfen“

Uber gehe davon aus, dass die Informationen nicht verwendet worden seien, hieß es. Die Hacker seien durch eine schlecht geschützte Datenbank an die Daten gekommen. Der Uber-Sicherheitschef Joe Sullivan wurde diese Woche entlassen, wie Uber weiter mitteilte.

Learn more / En savoir plus / Mehr erfahren:

https://www.scoop.it/t/securite-pc-et-internet/?&tag=DATA-BREACHES

https://www.scoop.it/t/securite-pc-et-internet/?&tag=Uber

Uber concealed a hack that affected 57 million customers and drivers, the company has confirmed.

The 2016 breach was hidden by the ride-sharing firm which paid hackers $100,000 (£75,000) to delete the data.
The company's former chief executive Travis Kalanick knew about the breach over a year ago, according to Bloomberg, which first broke the news.

The hackers found 57 million names, email addresses and mobile phone numbers, Uber said.
Within that number, 600,000 drivers had their names and license details exposed. A resource page for those affected has been set up.

Drivers have been offered free credit monitoring protection, but per Uber's statement, affected customers will not be given the same.
"While we have not seen evidence of fraud or misuse tied to the incident, we are monitoring the affected accounts and have flagged them for additional fraud protection," Uber's chief executive Dara Khosrowshahi said.

Learn more / En savoir plus / Mehr erfahren:

https://www.scoop.it/t/securite-pc-et-internet/?&tag=DATA-BREACHES

https://www.scoop.it/t/securite-pc-et-internet/?&tag=Uber

The largest hack in history just got three times worse for Yahoo.

"Following an investigation with the assistance of outside forensic experts, [we believe] that all Yahoo user accounts were affected by the August 2013 theft," Suzanne Philion, an Oath spokeswoman, said in a statement Tuesday.

Learn more / En savoir plus / Mehr erfahren:

http://www.scoop.it/t/securite-pc-et-internet/?&tag=DATA-BREACHES

Deloitte, one of the world's biggest accounting, auditing, and corporate finance consulting firms, has suffered a data breach.

Third hack at a financial institution this month

The company is one of the so-called "Big Four" accounting firms, together with Ernst & Young, KPMG, and PricewaterhouseCoopers. The Big Four provide accounting and other financial services to almost all major businesses across the globe.

The Deloitte hack is the third security breach at a major financial agency this month alone, after similar incidents at Equifax and the US Securities and Exchange Commission (SEC).

Kreditkarten-, Sozialversicherungs- und Ausweisnummern von mehreren Hundert Millionen US-Amerikanern sind in falsche Hände gelangt, als Equifax monatelang gehackt war. Dazu kommen weitere Opfer in Kanada und dem Vereinigten Königreich.

Learn more / En savoir plus / Mehr erfahren:

http://www.scoop.it/t/securite-pc-et-internet/?&tag=DATA-BREACHES

Equifax, one of the largest credit rating and reporting firm in the US, has become the latest company to reveal a data breach.

The incident was discovered on July 29, according to a company statement released after market close on Thursday.

The Atlanta, Georgia-headquartered company said that hackers had between mid-May through July exploited a vulnerability on its website to access certain files.

The data includes names, social security numbers, birth dates, home addresses, and in some cases, driving license information.

It's thought to be the largest data breach reported so far this year.

As many as 143 million Americans are said to be affected, the company said, representing about half of the US population.

Learn more / En savoir plus / Mehr erfahren:

http://www.scoop.it/t/securite-pc-et-internet/?&tag=DATA-BREACHES

Donald Trump may know more about hacking than he’s letting on.

That’s because it has been revealed that the US president’s family-run hotel business has once again been hit by hackers, who have stolen the payment card information from guests at 14 different Trump properties.

A letter posted on the Trump Hotels corporate website explained that the hackers broke into Sabre Hospitality Solutions, a reservation service used by Trump Hotels, to steal data:

Learn more / En savoir plus / Mehr erfahren:

http://www.scoop.it/t/securite-pc-et-internet/?&tag=DATA-BREACHES

The account details of millions of subscribers to the education platform Edmodo have not only been stolen but witnessed to be for sale on the dark web, according to a post on Motherboard.

The platform is used by more than 78 million teachers, students and parents to compose lesson plans, make homework assignments and other tasks.

Breach notification website LeakBase provided Motherboard with a sample of more than two million records, which included usernames, email addresses and hashed passwords. 
The good news is that the passwords apparently are hashed with the stealthy bcrypt algorithm, and a string of random characters known as a salt, which likely will make it more difficult for hackers to obtain users' login credentials. And, when staffers at Motherboard attempted to open Edmodo accounts using some of the purloined data, they were unsuccessful as the address was already linked to an Edmodo account, the report explained.

The bad news is that at least a portion of the database is up for sale on the dark web marketplace Hansa for $1,000. The seller, going under the name nclay, said s/he was in possession of 77 million accounts. LeakBase reported that 40 million of those come with an email address.

Learn more / En savoir plus / Mehr erfahren:

http://www.scoop.it/t/securite-pc-et-internet/?&tag=DATA-BREACHES

http://www.scoop.it/t/securite-pc-et-internet/?&tag=Edmodo+Insecurity

Yahoo has landed in trouble again as the company has been sending out emails to warn users state-sponsored attackers might have breached their accounts.

Learn more / En savoir plus / Mehr erfahren:

http://www.scoop.it/t/securite-pc-et-internet/?tag=DATA-BREACHES

http://www.scoop.it/t/securite-pc-et-internet/?tag=Yahoo..