Breach verification service LeakedSource claims it has obtained over 400 million user accounts stolen by hackers from social networking and multimedia entertainment company FriendFinder Networks, Inc.

According to LeakedSource, 412,214,295 accounts have been compromised, including usernames, email addresses and passwords. The data appears to originate from six websites operated by FriendFinder Networks and its subsidiaries.

There are nearly 340 million accounts from Adult Friend Finder, over 62 million from Cams.com, roughly 2.5 million from Stripshow.com and iCams.com, and more than 7.1 million from Penthouse.com, which FriendFinder Networks sold earlier this year to Penthouse Global Media, Inc. Approximately 35,000 accounts come from an unidentified domain.

Unfortunately, many of the passwords were stored in clear text, while the rest were converted to lowercase and stored as SHA1 hashes, which are easy to crack. LeakedSource says it has managed to crack 99 percent of the hashes.

The leaked data can be highly useful to malicious actors, especially the 5,650 .gov accounts and the 78,301 .mil accounts. The compromised information also includes data associated with more than 15 million accounts that had been deleted by AdultFriendFinder.com users.

LeakedSource has decided not to make the compromised data searchable on its website for the general public. If confirmed, this is the largest incident analyzed by the breach notification service.

The company said the user data was stolen by attackers via a local file inclusion vulnerability disclosed by a hacker roughly one month ago. CSO reported at the time that the hacker exploited the flaw to show that it exposed information on Adult Friend Finder databases.

SecurityWeek has reached out to FriendFinder Networks for comment and will update this article if the company responds.

This would not be the first time the details of Adult Friend Finder users are exposed. In May 2015, the website launched an investigation into a breach that reportedly affected over 3.5 million customers.

Last year, hackers also breached the systems of Avid Life Media, the owner of online adultery service Ashley Madison. The details of more than 30 million Ashley Madison users were leaked on the Internet.

Related: Lessons from the Movie Industry - Sequels are Profitable

Related: The Cyber Risk of Mixing Business with Pleasure

Previous Columns by Eduard Kovacs:

Tags:

Attorneys general in over a dozen U.S. states announced on Thursday that they reached a $1 million settlement with Adobe Systems over the massive data breach suffered by the company in 2013.

Authorities in 15 states accused Adobe of failing to employ reasonable measures to protect customers’ personal information and promptly detect malicious activity within its network. As part of the settlement, the software giant has agreed to implement new policies and practices in an effort to prevent similar breaches in the future.

The measures that Adobe must take include effectively segregating payment card data from public-facing servers, using tokenization in payment processing, performing ongoing risk assessments and penetration testing, and providing security training to employees.

The $1 million will be paid by Adobe to attorneys general as designated by the Connecticut Attorney General’s Office, which led the investigation into the data breach.

Connecticut AG George Jepsen announced that his state will get $135,095.71, of which $25,000 will go to the Department of Consumer Protection's consumer privacy protection guaranty and enforcement account, and the rest to the state's General Fund.

The other states involved in the investigation are Arkansas, Illinois, Indiana, Kentucky, Maryland, Massachusetts, Missouri, Minnesota, Mississippi, North Carolina, Ohio, Oregon, Pennsylvania and Vermont.

Adobe realized that its systems were breached in September 2013, when it noticed that one of its application servers’ hard drive was nearly full. An investigation revealed that unauthorized parties had been trying to decrypt encrypted customer payment card numbers.

Adobe confirmed at the time that the attackers managed to steal user information and source code, but claimed there was no evidence that any unencrypted payment card numbers were exfiltrated. The breach was believed to affect 38 million Adobe customers and some reported that more than 150 million records were compromised.

In 2015, the company settled a class action and agreed to pay an undisclosed amount to users and roughly $1.2 million in legal fees.

Related: Adobe Breached Privacy Act, Says Australian Information Commissioner

Previous Columns by Eduard Kovacs:

Tags:

RiskIQ, a company that helps detect digital threats stemming from areas such as the Web, malvertising and social media, announced that it has closed $30.5 million in a Series C funding round led by Georgian Partners. 

This latest funding round brings the total raised by the San Francisco, Calif.-based company to more than $65 million. 

The company explains that its platform leverages machine learning and big data to help enterprises “defend their digital attack surface, pinpoint exposures across their business, and dynamically mitigate cyber threats across web, mobile, and social.”

By using raw internet data collected by its crawlers and internet sensors to continuously map and find threats across an organization’s attack surface, the RiskIQ platform helps enterprise security staff understand new threats, speed up investigations, and more effectively prevent and remediate incidents. 

The company counts more than 200 enterprise customers using the RiskIQ platform, including names such as Facebook, DocuSign, Under Armour, Box, and TripAdvisor. In the first half of 2016, the company reported year-over-year bookings growth of 80 percent.

“Threats start outside the firewall, move inside, and exfiltrate data back outside – and all the while malicious actors can compromise a company’s digital assets, vendors, and customers across web, mobile, and social environments,” said Greg Goldfarb, managing director at Summit Partners. “RiskIQ lights up the entire digital world outside of the controlled perimeter and connects that activity to a company’s internal security regime for 360-degree security.”

Existing investors Summit Partners, Battery Ventures, and MassMutual Ventures also participated in the round. The company raised $25 million in its Series B round in May 2014. 

For more than 10 years, Mike Lennon has been closely monitoring and analyzing trends in the enterprise IT security space and the threat landscape. In his role at SecurityWeek he oversees the editorial direction of the publication and manages several leading security conferences.

Previous Columns by Mike Lennon:

Tags:

When it comes to Internet of Things (IoT) devices, everything from smart glasses to connected cars is susceptible to malware infection if not properly secured, Fortinet senior researcher Axelle Apvrille said in a presentation at the DefCamp 2016 security conference in Bucharest, Romania this week.

CCTV cameras, DVRs and network routers have made headlines recently as vulnerable IoT devices due to their connection to distributed denial of service (DDoS) botnets such as Mirai and Bashlite, but malware could target more devices, including smart toys, home appliances, wearables, and more. In fact, the future could be a dark one for such devices and for their users, the researcher says.

The only required trigger for such attacks to become norm would be for the cymbercriminals to find a way to monetize such infections. “Ultimately, the purpose of IoT malware is financial. It’s the money that their developers are after, the same as those behind other malware out there,” Apvrille told SecurityWeek at the conference.

The computing power of targeted devices doesn’t even matter, she explained. As long as these devices have an Internet connection that can be exploited to send spam messages or launch distributed denial of service attacks, malware authors will be interested in them, especially since Mirai has shown that they can be easily compromised.

“If a device has firmware, there could be some room left for an attacker to install malware, because it doesn’t have to be complex malicious code. In fact, such malware only needs 4 bytes of memory,” the security researcher explained.

With actors targeting less complex devices, it might not be too long before IoT malware completely surrounds us, Apvrille explained. It only takes a single vulnerable entry point for attackers to find and exploit, and entire home or corporate networks could be infected via a connected device.

Security researchers previously explained that the main purpose of IoT malware is to launch of DDoS attacks, but Apvrille says that these devices could be infected for other nefarious purposes as well, including ransomware, Trojans, and spyware.

During her presentation at DefCamp 2016, Apvrille not only theorized that all IoT devices are susceptible to compromise if exposed to the Internet, but also demonstrated how simple the malicious programs that would infect them could be. A functional piece of malware can have only a few tens of lines of code, the researcher explained.

Apvrille demonstrated how a piece of ransomware on a pair of smart glasses running Android could render the device unusable or could be used to record users’ activity and subsequently extort them threatening to release the video online. The possibilities that a ransomware attack offers in such a scenario are diverse.

Malicious code could be installed via spam email, a popular distribution method these days. Other attack vectors could also be used, including malicious images. The researcher demonstrated how an attacker could pack malware inside a seemingly benign image that automatically triggers the installation when opened.

It’s not only ransomware that these smart glasses could be targeted with, but the entire range of malicious apps built for Android. There are around 5,000 new Android malware variants emerging each day and smart glasses could be vulnerable to them as well. The lack of Internet connectivity makes the operating system upgrades difficult on such devices, which means that patched vulnerabilities continue to haunt them for as long as they are used.

Smart watches are also vulnerable and are susceptible to even more diverse malware attacks, the researcher says. These devices have been designed as companions for the smartphone, and cybercriminals could try to compromise the smartphone through them. For example, a malicious app could turn the smart watch into a SMS Dialer so that a message would be sent to a premium number each time the user touched its screen.

All types of connected devices could be vulnerable to malware attacks, but their exploitation criticality increases with their price, because more expensive devices could pose higher interest to threat actors, thus increasing the risk of them being infected. An infection on some of these devices could even turn into a life-threatening situation.

Last month, Rapid7 researcher Jay Radcliffe revealed that Animas’ OneTouch Ping insulin pumps are plagued by several vulnerabilities that could allow an attacker to compromise devices and potentially harm diabetic patients. Despite being a serious security issue, however, the vendor doesn’t plan to rectify it via a firmware update, because the devices are considered to pose a relatively low risk.

According to Apvrille, malicious actors could install ransomware on insulin pumps or blood pressure monitoring devices and determine people to pay the ransom by threatening their lives.

Cybercriminals could also target connected cars and threaten to disable critical vehicle functions if a ransom isn’t paid in a given period of time. Instead of getting the car to a repair shop, which might take a lot of time and could cost as much as the ransom, the user might pay up. Security researchers have already demonstrated vulnerabilities in connected cars, which makes such scenarios plausible.

The security risks associated with IoT devices have been discussed before, but they returned to focus recently, when Mirai and similar botnets came into the spotlight. However, IoT devices shouldn’t fear only DDoS botnets, ransomware, spyware, and Trojans, but disruptive malware as well. Earlier this week, a group of security researchers demonstrated how an IoT worm could be used to hack all smart lights in a city and how setting up such an attack was rather cheap.

“There is a new path of least resistance, which Mirai so well illustrated. Consumer connected devices are generally not built with security in mind. The software that powers these devices isn’t tested to the same level that a financial institution will test a Web application. The hardware, firmware, and OS isn’t sufficiently hardened against attack. If a password exists, it is weak and widely published in support documentation that is broadly available on the Internet,” Cigital’s Jim Ivers noted in a recent SecurityWeek column.

Because of these vulnerabilities and lack of security standards, any IoT device in a smart home could represent a vulnerable entry point for a malware attack. By compromising a toothbrush, a toaster, or a refrigerator, an attacker could then spread malware to other devices on the network, including computers and smartphones.

Related: IoT Worm Could Hack All Smart Lights in a City

Related: The Connected Conundrum: Why I No Longer Trust My Toaster

Ionut Arghire is an international correspondent for SecurityWeek.

Previous Columns by Ionut Arghire:

Tags:

A Florida man is the latest person to be charged in connection with alleged illegal activities associated with coin.mx, a now defunct unlicensed bitcoin exchange. Riccardo Hill, a resident of Brandon, Florida was charged with conspiring to operate an unlicensed money transmitting business. He was released Thursday on a $75,000 bond following a court appearance in Manhattan.

Hill, 38, was arrested in October. He is the ninth person to be arrested following the investigation into the JPMorgan data breach that was disclosed in 2014. Prosecutors claim that coin.mx was owned by Gery Shalon, an Israeli charged with masterminding the hacks that breached JPMorgan and other companies.

Shalon, and Ziv Orenstein (another Israeli) were arrested in Israel in July 2015. They were extradited to the US and pleaded not guilty to a hacking and fraud scheme including but not limited to JPMorgan. Prosecutors said the scheme dated back to 2007 and compromised more than 100 million people's personal information.

A third individual, Joshua Aaron from Florida, is also wanted in connection with these charges. Aaron is believed to have fled to Russia, which he frequently visited. This has led to some suggestions that the actual hacker (rather than the orchestrators) of the JPMorgan hack and others may be Russian. Last month Bloomberg reported that Aaron had been located in Russia, but is no longer welcome there. "The only American suspect named in the largest known hack of Wall Street is negotiating his return to the U.S. from a detention cell in Russia, where he's no longer welcome."

The investigation into the JPMorgan breach led to Sharon, and Sharon led to coin.mx. Coin.mx seems to have been used as a laundering facility for other criminal activities, including the proceeds of ransomware. It is possible that the personal details stolen from the JPMorgan and other hacks helped facilitate some of this illegal activity.

Coin.mx was operated by Anthony Murgio, also from Florida. He and four others associated with the bitcoin exchange were arrested around the same time as Shalon. At that time the FBI stated: "Murgio and his co-conspirators knowingly enabled the criminals responsible for those attacks to receive the proceeds of their crimes, yet, in violation of federal anti-money laundering laws, Murgio never filed any suspicious activity reports regarding any of the transactions."

The latest charge against Hill claims that he was employed as a finance support manager and business development consultant for an unlicensed bitcoin exchange, that is, Coin.mx. The complaint against Hill claims that he and others profited from numerous bitcoin transactions conducted on behalf of victims of schemes involving ransomware. 

Of the five other individuals arrested in connection with coin.mx, two have pleaded guilty. Murgio and two others have pleaded not guilty, and will face trial in February 2017. Neither Murgio nor Hill is accused of direct involvement with hacking.

Kevin Townsend is a Senior Contributor at SecurityWeek. He has been writing about high tech issues since before the birth of Microsoft. For the last 15 years he has specialized in information security; and has had many thousands of articles published in dozens of different magazines – from The Times and the Financial Times to current and long-gone computer magazines.

Previous Columns by Kevin Townsend:

Tags:

Job-related information belonging to hundreds of thousands of individuals was exposed online after Capgemini inadvertently made public a database of Michael Page, a brand of UK-based global recruitment company PageGroup.

France-based Capgemini, which last year had a revenue of nearly 12 billion euros, specializes in consulting, technology and outsourcing services. The company, contracted by the recruitment giant for IT services, unintentionally exposed a Michael Page backup database containing an estimated 30 Gb of SQL files that could have been accessed by anyone who knew what to look for.

The leak was brought to the attention of Australian security expert Troy Hunt by an individual who last month discovered a similar leak involving the Australian Red Cross Blood Service. The personal details of 550,000 individuals were exposed in the Red Cross incident.

After investigating the leak, PageGroup and Capgemini determined that the data was posted to a development server used for testing PageGroup websites. The recruitment firm notified customers that names, email addresses, encrypted passwords, phone numbers and job-related information was exposed in the incident.

Hunt said a single one of the database files contained 780,000 unique email addresses and other job details. The expert learned about the leak in late October, but waited until now to make it public to give the affected companies enough time to address the issue.

PageGroup believes the data is unlikely to be misused since it appears that only Hunt and the individual who tipped him off accessed it, and they both claim to have destroyed all the copies they had. The company told affected customers that they don’t need to change their passwords.

“We have ensured the website is secure. We are treating this issue very seriously and are working with our IT vendor, Capgemini as a matter of urgency to fully investigate how this incident occurred and to put in place measures to ensure it does not happen again,” PageGroup stated. “Capgemini fully manage our PageGroup websites and is regarded as a global leader in consulting, technology and outsourcing services. It has all the appropriate security certificates and ISO certifications in place, which we believed would ensure that the website environments would be secure and safe in their hands.”

Hunt pointed out that organizations of all sizes can be affected by serious vulnerabilities. The expert believes companies could avoid such incidents by running bug bounty programs, which have been increasingly popular among both public and private organizations.

“These were such low-hanging vulnerabilities that had there been even the slightest inkling of incentivisation, they would have been found very quickly and reported ethically via a channel that researches could trust,” Hunt commented.

Previous Columns by Eduard Kovacs:

Tags: