Ethical hacker backer hacked, warns of email ransack

he IT security certification body that runs the Certified Ethical Hacker programme has itself been hacked.
The EC-Council said the same hackers who ran the DNS poisoning attack that resulted in the defacement of its website in late February had also managed to access the control panel for its website after breaking into the systems of a third-party registrar. This compromised access allowed the miscreants to circumvent security controls and get into the security organisation's email system, as a breach notice from the EC-Council to its members explains.

EC-Council uses a cloud service provider for enterprise email. Once the domain privilege was attained, the hacker then issued a password reset request to the email service provider. This circumvented EC-Council's best practices of using complex passwords and 2-factor authentication. We have informed the service provider of this password reset policy vulnerability and are hopeful that they have already rectified it for the benefit of the IT community in general. With administrative access to the email service provider, the hacker was able to compromise a small number of email accounts before the EC-Council security team was able to respond to the breach.This resulted in unauthorized access to messages in those specific email boxes for a short duration of time.

The investigation into the breach is still ongoing and it's unclear which member data, if any, has been exposed. Credit card transactions are run through a different system that wasn't exposed by the attack but any private information sent by email might have been compromised, although this is uncertain.
"As a precautionary measure, we are writing to notify members that have sent any personally identifiable information to EC-Council via email that there is a possibility that these may have been exposed through email," the breach notification from the EC-Council explains. "No credit card data was compromised."
The US-based EC-Council runs the Certified Ethical Hacker programme, C|EH and other certifications. The organisation – whose tagline is Hackers are here. Where are you? – asks members to submit sensitive data such as passport details as part of its registration process. The leak of this data is obviously the main concern raised by the breach.
In response to the incident, the EC-Council has promised to tighten up its security procedures.
The organisation said in a statement on the breach that went out on yesterday:

EC-Council strives to set a very high bar for how they serve their community, and this incident is upsetting. EC-Council has since transferred their domain to another registrar, changed policies on management of personal information, improved existing data retention policies, introduced two-factor authentication for member portals, and improved security procedures and systems. ®

Bootnote

A shout-out to Mark, an infosec contractor going for CEH accreditation, who tipped us off about the EC-Council's breach notification to its members.

Justin Bieber is the latest celebrity to have his Twitter account hacked

A few years ago I joked that the only reason I followed Britney Spears on Twitter was to get an early heads-up on when she next had her account hacked.
Actually, thinking back, I wasn’t joking.
It felt like barely a month went by without the singer having her account compromised.
And if her high profile account was exploited, chances were that plenty of her adoring fans were also likely to blindly click on the links without thinking of the possible consequences (too obvious ones being a phishing attack or a malware infection).
Here’s an example from January 2009, when Britney Spears had a lowly 14,000 followers. (Today she has over 36 million. Wow, hasn’t time moved on?)

Well, time has moved on and Britney’s superstar status has diminished a little. After all, there are new kids on the block like Justin Bieber.
Bieber, who like the Britney of old appears to be going through a public car-crash for the benefit of the paparazzi, has an astonishing 50 million followers on Twitter.
And anyone with that kind of social media audience becomes an obvious attraction to social media scammers and online criminals.
Sure enough, this weekend, Justin Bieber appeared to be no longer in charge of his Twitter account – at least for a short time – as messages appeared in Indonesian linking to an Android app called Shooting Star Pro.

Within seconds, Bieber’s fanatical followers were favoriting and retweeting his message regardless, one assumes, of whether they were able to understand them.
Cemberut, by the way, is an Indonesian word meaning sullen or grumpy, and is sometimes used by social media users alongside downcast selfies of themselves.
What isn’t clear is how Bieber’s account was compromised. Did he, or whoever manages his social media accounts, authorise a rogue third party app to post on the Twitter account without thinking of the possible consequences, was he specifically targeted or was someone careless with their password?
Whatever the reason for the unexpected tweets, a warning was quickly posted on the account advising followers not to click on the links.

That link from earlier. dont click it. virus. going to erase this now. spread the word. thanks

Later that message was deleted, and replaced with another claiming that everything was now under control:

all good now. we handled it.

Scammers, spammers and online criminals love to take advantage of innocent people’s social media accounts, because it’s a very effective launchpad for their money-making campaigns.
It’s not just celebrities like Britney Spears, Justin Bieber and Kevin Bacon who fall victim. Many regular members of the public have their social networking accounts compromised every day, and it’s their online friends and family who are duped as a result into visiting dangerous links, believing it is their pal or loved one who shared them.
Always be sure to take care over your passwords (ensuring you only enter them on the legitimate site for which they were designed, and not reusing the same password), be cautious over what third-party apps you grant access to your account, and take advantage of features like two factor authentication to better control access to your accounts.
And maybe it’s time to think twice before rushing to click on a link, next time your favourite celebrity says something bizarre on Twitter.