Network Solutions hacked, 500,000 card numbers compromised

Another major data breach this time Network Solutions which offers security products such as SSL certificates is the latest to be compromised at the tune of 500,000+ credit/debit cards.

This attack seemed to be very sophisticated and the company claims the had maintained PCI compliance during the time of the hack. This is a huge one for the industry as it will spark a huge PCI works/doesn't work debate and it's perfectly timed as industry conferences BlackHat and Defcon start in Las Vegas this week.

References:

Washington Post

Finextra
SC Magazine

Forum Compromise gives insight into password security

A large programing forum (PHPBB) was recently hacked and 20,000 account passwords were posted online and in plain text by the attacker. Like last years Myspace account hack the was an excellent mining tool for security researchers to analyze common passwords and average password strength.

Here are the most commonly used passwords, notice #2 matched the forum name of PHBB. Other interesting weak passwords of note as the permutations of 123456 and the always popular "letmein" and "qwerty". This list is also probably a great source for a brute force dictionary on pen-testing.

3.03% "123456"
2.13% "password"
1.45% "phpbb"
0.91% "qwerty"
0.82% "12345"
0.59% "12345678"
0.58% "letmein"
0.53% "1234"
0.50% "test"
0.43% "123"
0.36% "trustno1"
0.33% "dragon"
0.31% "abc123"
0.31% "123456789"
0.31% "111111"
0.30% "hello"
0.30% "monkey"
0.28% "master"
0.22% "killer"
0.22% "123123"

RedHat Linux Compromised

Last night Red Hat Inc. announced that their main distribution servers were compromised and this morning patches were released to fix apparently modified OpenSSH packages.

This is an incredibly interesting vector of attack, both releases of Red Hat Enterprise Linux v4, v5 and Fedora were modified with attackers essentially including their own key to the front door (ssh) into the operating system. If you have installed RHEL or Fedora from ftp or http sources recently you will certainly need to: "yum update"

https://www.redhat.com/archives/fedora-announce-list/2008-August/msg00012.html
https://rhn.redhat.com/errata/RHSA-2008-0855.html
http://www.redhat.com/security/data/openssh-blacklist.html