Page 3 of 3 FirstFirst 123
Results 21 to 27 of 27

Thread: Cloud computing - episodes ...

  1. #21
    Adviser Team AplusWebMaster's Avatar
    Join Date
    Oct 2005
    Location
    USA
    Posts
    6,881

    Thumbs down Dropbox used by hacks to spread malware

    FYI...

    Dropbox used by hacks to spread malware
    - http://www.nbcnews.com/technology/dr...are-6C10642402
    July 15, 2013 - "... Comment Crew*, the same Chinese cyberespionage team thought to be behind the recent attack on The New York Times, has been using publicly shared Dropbox folders** to spread malware, reports... Cyber Squared. "The attackers have simply registered for a free Dropbox account, uploaded the malicious content and then publicly shared it with their targeted users," a Cyber Squared blog posting*** explained last week. For malicious hackers, Dropbox is an attractive malware distribution platform because it's widely used in the corporate environment and is unlikely to be blocked by IT security teams. In this way, Cyber Squared wrote, "the attackers could mask themselves behind the trusted Dropbox brand, increasing credibility and the likelihood of victim interaction with the malicious file from either personal or corporate Dropbox users"..."
    * http://www.technewsdaily.com/17012-f...r-reports.html

    ** http://www.technewsdaily.com/4196-2-...e-syncing.html

    *** http://www.cybersquared.com/killing-...cyber-attacks/

    Last edited by AplusWebMaster; 2013-07-19 at 19:36.
    The machine has no brain.
    ......... Use your own.
    Browser check for updates here.
    YOU need to defend against -all- vulnerabilities.
    Hacks only need to find -1- to get in...
    .

  2. #22
    Adviser Team AplusWebMaster's Avatar
    Join Date
    Oct 2005
    Location
    USA
    Posts
    6,881

    Thumbs down Malware in the cloud - 2014 ...

    FYI...

    Malware in the cloud - 2014
    - https://net-security.org/malware_news.php?id=2675
    Jan 15, 2014 - "... malware distributors are rapidly and widely adopting cloud computing, either by buying services directly or by compromising legitimate domains. This trend is allowing distributors to quickly and cost-effectively develop sites and bring them online, as well as to avoid geographic blacklisting by hiding behind the reputations of major hosting providers such as Amazon, GoDaddy and Google... The cloud is allowing malware distributors to create, host and remove websites rapidly, and major hosting providers such as Amazon, GoDaddy and Google have made it economical for malicious actors to use their services to infect millions of computers and vast numbers of enterprise systems..."
    ___

    IBM to spend $1.2 billion to expand cloud services
    - http://www.reuters.com/article/2014/...A0G05P20140117
    Jan 16, 2014 - "IBM Corp said it will invest more than $1.2 billion to build up to 15 new data centers across five continents to expand its cloud services and reach new clients and markets. The new cloud centers will be in Washington D.C., Mexico City, Dallas, China, Hong Kong, London, Japan, India and Canada, with plans to expand in the Middle East and Africa in 2015... IBM said the global cloud market is estimated to grow to $200 billion by 2020... it will use web hosting technology from SoftLayer for the delivery of its cloud services..."

    Last edited by AplusWebMaster; 2014-01-17 at 15:59.
    The machine has no brain.
    ......... Use your own.
    Browser check for updates here.
    YOU need to defend against -all- vulnerabilities.
    Hacks only need to find -1- to get in...
    .

  3. #23
    Adviser Team AplusWebMaster's Avatar
    Join Date
    Oct 2005
    Location
    USA
    Posts
    6,881

    Exclamation Creative Cloud crash - no cloud is too big to fail

    FYI...

    Creative Cloud crash - no cloud is too big to fail
    Adobe's ID services went down for over 24 hours, leaving Creative Cloud users - and a great many others - locked out of their software and accounts
    - http://www.infoworld.com/t/cloud-com...ig-fail-242674
    May 16, 2014 - "A problem with Adobe Creative Cloud locked users of Adobe's software out of their programs - and a good deal else on top of that - for more than 24 hours starting Wednesday night. According to a blog post by Adobe*, the failure "happened during database maintenance activity and affected services that require users to log in with an Adobe ID." This includes Adobe's Creative Cloud service, which provides cloud-hosted and -managed versions of Adobe's flagship software, such as Adobe Photoshop and Adobe Premiere... every other Adobe service that used Adobe's ID system was also affected... This isn't the first cloud-related black eye Adobe's suffered, either. Last year Adobe admitted to having 130 million passwords stolen from a backup system that was to have been decommissioned. Many Facebook accounts were also indirectly affected. Adobe's also received sharp criticism for aggressively shepherding its users into cloud subscription, pay-as-you-go plans for its software; in 2013 Adobe stopped selling standalone editions of the Creative Suite altogether... no cloud infrastructure is too big or too important to fail. Dropbox went down for 16 hours in January of 2013, and Google Drive experienced a similar 17-hour meltdown of its own in March. One estimate has put the cost of major-league cloud outages at some $71 million since 2007, but failures like Adobe's - where a single piece of failing infrastructure brings down multiple systems - have most likely driven that estimate far higher..."
    * http://blogs.adobe.com/adobecare/201...ervice-outage/
    ___

    - http://www.theinquirer.net/inquirer/...an-application
    May 19 2014 - "IBM HAS LAUNCHED a version of Openstack that can be downloaded directly from its Marketplace like any other application. IBM Cloudmanager with Openstack is based on IBM Cloudentry, and includes full access to Icehouse, the latest version of Openstack. As well as appearing in its own right, it can also be bought as part of a package along with the recently announced IBM Power Systems server range to form the extensively titled IBM Power Systems Solution Edition for Scale Out Cloud..."

    Last edited by AplusWebMaster; 2014-05-19 at 20:11.
    The machine has no brain.
    ......... Use your own.
    Browser check for updates here.
    YOU need to defend against -all- vulnerabilities.
    Hacks only need to find -1- to get in...
    .

  4. #24
    Adviser Team AplusWebMaster's Avatar
    Join Date
    Oct 2005
    Location
    USA
    Posts
    6,881

    Thumbs down Amazon cloud attackers install DDoS bots ...

    FYI...

    Amazon cloud attackers install DDoS bots ...
    Attackers are targeting Amazon EC2 instances with Elasticsearch 1.1.x installed
    - https://www.computerworld.com/s/arti...earch_weakness
    July 28, 2014 - "Attackers are exploiting a vulnerability in distributed search engine software Elasticsearch to install DDoS malware on Amazon and possibly other cloud servers. Elasticsearch is an increasingly popular open-source search engine server developed in Java that allows applications to perform full-text search for various types of documents through a REST API (representational state transfer application programming interface). Because it has a distributed architecture that allows for multiple nodes, Elasticsearch is commonly used in cloud environments. It can be deployed on Amazon Elastic Compute Cloud (EC2), Microsoft Azure, Google Compute Engine and other cloud platforms. Versions 1.1.x of Elasticsearch have support for active scripting through API calls in their default configuration. This feature poses a security risk because it doesn't require authentication and the script code is -not- sandboxed. Security researchers reported earlier this year that attackers can exploit Elasticsearch's scripting capability to execute arbitrary code on the underlying server, the issue being tracked as CVE-2014-3120* in the Common Vulnerabilities and Exposures (CVE) database. Elasticsearch's developers haven't released a patch for the 1.1.x branch, but starting with version 1.2.0, released on May 22, dynamic scripting is disabled by default. Last week security researchers from Kaspersky Lab** found new variants of Mayday, a Trojan program for Linux that's used to launch distributed denial-of-service (DDoS) attacks. The malware supports several DDoS techniques, including DNS amplification. One of the new Mayday variants was found running on compromised Amazon EC2 server instances, but this is not the only platform being misused... Users of Elasticsearch 1.1.x should upgrade to a newer version and those who require the scripting functionality should follow the security recommendations made by the software's developers in a blog post*** on July 9."

    * https://web.nvd.nist.gov/view/vuln/d...=CVE-2014-3120 - 6.8

    - https://web.nvd.nist.gov/view/vuln/d...=CVE-2014-4326 - 7.5 (HIGH)

    - http://www.elasticsearch.org/blog/logstash-1-4-2/
    Jun 24
    Changelog for 1.4.2
    - https://github.com/elasticsearch/log...ster/CHANGELOG

    ** https://securelist.com/blog/virus-wa...os-and-profit/

    *** http://www.elasticsearch.org/blog/scripting-security/

    - https://www.found.no/foundation/elas...-elasticsearch

    Insecure default in Elasticsearch enables remote code execution
    - http://bouk.co/blog/elasticsearch-rce/
    May 2014 - "... How to secure against this vulnerability..."
    ___

    >> http://www.rapid7.com/db/modules/exp...cript_mvel_rce
    ___

    - http://atlas.arbor.net/briefs/index#-961013762
    High Severity
    31 Jul 2014

    Last edited by AplusWebMaster; 2014-08-01 at 17:06.
    The machine has no brain.
    ......... Use your own.
    Browser check for updates here.
    YOU need to defend against -all- vulnerabilities.
    Hacks only need to find -1- to get in...
    .

  5. #25
    Adviser Team AplusWebMaster's Avatar
    Join Date
    Oct 2005
    Location
    USA
    Posts
    6,881

    Post Azure cloud outages ...

    FYI...

    Azure cloud restored after major outage...
    - http://www.theinquirer.net/inquirer/...a-major-outage
    Aug 19 2014 - "Microsofts's Azure Cloud Service has encountered partial, and in some cases complete, outages around the world. Twitter users have reported Azure being slightly wobbly for the past few days, and then last night a number of outage reports were posted on the Azure service status webpage*..."
    * https://azure.microsoft.com/en-us/status/#history

    Also see: Sep/Oct 2014 history @ URL above.
    ___

    - http://www.netskope.com/blog/84-euro...-confidential/
    Sep 17, 2014 - "84% of European IT and security practitioners report that they don’t believe their cloud service providers would notify them immediately if their intellectual property or business confidential information were breached. This finding is from our most recent report entitled “Data Breach: The Cloud Multiplier Effect in European Countries,” a collaboration with research firm the Ponemon Institute*. It highlights the profound lack of trust that European IT professionals have in the cloud, and the significant hurdle the industry must overcome for those professionals to get comfortable with the massive cloud adoption that is happening in enterprises across the region."
    * http://www.ponemon.org/blog/can-a-da...ostly-incident

    - http://www.netskope.com/reports/pone...iplier-effect/
    "... highlights from the report:
    • Increasing use of cloud services can increase the probability of a $20 million data breach by as much as 3x
    • 36 percent of business-critical applications are housed in the cloud, yet IT isn’t aware of nearly half of them
    • 30 percent of business information is stored in the cloud, yet 35 percent of it isn’t visible to IT ..."

    Last edited by AplusWebMaster; 2014-10-14 at 00:48.
    The machine has no brain.
    ......... Use your own.
    Browser check for updates here.
    YOU need to defend against -all- vulnerabilities.
    Hacks only need to find -1- to get in...
    .

  6. #26
    Adviser Team AplusWebMaster's Avatar
    Join Date
    Oct 2005
    Location
    USA
    Posts
    6,881

    Thumbs down Dropbox glitch leaves some users with deleted files

    FYI...

    Dropbox glitch leaves some users with deleted files
    - http://www.theinquirer.net/inquirer/...-deleted-files
    Oct 13 2014 - "... a 'glitch' in some versions of the Dropbox app resulted in the deletion of files... The bug occurred when certain versions of the desktop sync app were shutdown prematurely by a program or system crash, and was limited to users of the selective sync feature where only certain folders are replicated on the desktop..."

    The machine has no brain.
    ......... Use your own.
    Browser check for updates here.
    YOU need to defend against -all- vulnerabilities.
    Hacks only need to find -1- to get in...
    .

  7. #27
    Adviser Team AplusWebMaster's Avatar
    Join Date
    Oct 2005
    Location
    USA
    Posts
    6,881

    Exclamation The 'IoT' time bomb ...

    FYI...

    The 'IoT' time bomb ...
    - http://www.networkworld.com/article/...time-bomb.html
    May 11, 2015 - "IBM’s Andy Thurai didn’t quite put the words into former RSA CTO Deepak Taneja’s mouth, but did prompt him by asking at the start of a TIE Startup Con panel in Cambridge, Mass., earlier this month whether Internet of Things security is a 'time bomb ready to explode'. Taneja responded that technology is advancing at a rate that’s -outstripping- enterprises’ ability to secure internal and -cloud- resources, and then along comes IoT in the form of all sorts of networked sensors and gadgets. 'Organizations aren’t spending that much on security. It’s increasing, but it’s not enough and IoT only makes it worse,’ he said. 'So it is a time bomb. Money will start being spent on IoT security once serious breaches occur...'" (-After- the fact.)

    - http://www.theinquirer.net/inquirer/...e-attack-crazy
    May 21 2015 - "... Akamai's regular report paints a detailed picture of the threat landscape. The view this year so far was blighted by the DoS attack to an even greater degree than during the previous quarter. The firm said that the number of such attacks increased by around a third during the period and by over 100 percent against the same period last year. The largest distributed DoS (DDoS) attack during the quarter peaked at 170Gbps. Attacks on Simple Service Discovery Protocol systems made up 20 percent of DoS attacks, mainly targeting Internet of Things devices..."

    - http://blog.trendmicro.com/trendlabs...-is-it-anyway/
    May 26, 2015 - "... All of these devices are generating one thing: data. The smartwatch is keeping track of my health data. The thermostat is keeping track of what’s going on inside my home. The cameras are keeping track of what they see and when they are turned on. A lot of this data is passed on to the providers of these services, which frequently say they are “free”... Service providers can – and already, are – using Big Data to provide 'improved services to their customers'. In a way, they already know you better than you know yourself. Who is in control of all this data? Is it us consumers, or is it the service providers? What happens to the data – is it used just to provide services to the customers, or is it also sold off to other third parties? Businesses may say as part of their terms of service that they won’t -sell- your information, but is that really the case? When the American retailer RadioShack went bankrupt, customers may have -thought- that their personal information would simply vanish into thin air, but that wasn’t the case. RadioShack is actually trying to -sell- this information... This includes your name, address (both physical and e-mail), phone number, and what items you bought. You may not feel this information is particularly secret, but few of us would be happy to see this info sold to the highest bidder. It’s a good thing that several states have expressed concern about this, as ordinary consumers deserve to have their information protected. Consider who could be interested in the data that your smart devices collect. Your health insurance would be very interested; imagine if they -charged- people who didn’t meet their daily steps goal higher premiums... What’s important is consent and opt-in. Users need to be in control of their data – who gets it, and what is it used for... The Internet of Things can be a venue for innovation and new possibilities, but it can also be used to break basic notions of privacy and confidentiality. Companies should endeavor to keep the interests of users in mind, otherwise... government regulations... used to protect consumers. This may have consequences that we cannot predict..."

    >> https://en.wikipedia.org/wiki/Intern...hings#Security
    11 Aug 2015

    > https://en.wikipedia.org/wiki/Web_of_Things#History
    11 Aug 2015

    Last edited by AplusWebMaster; 2015-08-12 at 19:55.
    The machine has no brain.
    ......... Use your own.
    Browser check for updates here.
    YOU need to defend against -all- vulnerabilities.
    Hacks only need to find -1- to get in...
    .

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •