UPDATED 14:13 EDT / JUNE 06 2012

NEWS

Cyberthreat Weekly: Flame Virus Discovery and More Reports of Cyber Breaches

The digital age has only made its ingress but the world has seen a great deal of nasty viruses infecting computers. The most recent one–and perhaps the most lethal–is Flame virus. It was detected by Russian security researchers from Kaspersky Labs, infecting units in Iran and other MidEast countries. Flame gathered private data from compromised computer systems in a very sophisticated manner that it is believed to be state-sponsored. It collected network traffic, take screenshots, remotely change computer settings, initiates and records audio, and intercepts the keyboard input.

Another interesting fact about Flame is that it’s such a significantly large piece of code that has gone undetected for two years. That being said, it existed alongside DuQu and Stuxnet which were also very powerful cyber weapons. Flame virus code is about 20 times the size of Stuxnet’s though it takes advantage of the same flaw Stuxnet does in Windows to exploit and spread.

“It’s a very big chunk of code. Because of that, it’s quite interesting that it stayed undetected for at least two years,” Gostev said. He noted that there are clues that the malware may actually date back to as early as 2007, around the same time-period when Stuxnet and DuQu are believed to have been created”

Moving on, the student information database of the University of Nebraska was breached last Wednesday and compromised private from 650,000 individuals. The information includes Social Security numbers, addresses, grades, transcripts, housing and financial aid information for current and former NU students as well as student applicants who may or may not have attended NU. There’s no definite proof that the data were actually accessed or downloaded but the university’s security officer Joshua Mauk still spoke of the possibility.

“The University of Nebraska takes the protection of student and alumni information very seriously. Right now we’re focused on determining the exact nature of the breach and communicating with those who may have been affected,” Mauk said in a statement. “We are working with law enforcement and forensics experts to thoroughly reconstruct this incident so that we can identify limitations in our system and put new safeguards in place for the future.”

In another hacking incident, the Utah Department of Technology Service and the Utah Department of Health was breached in early April by Eastern European hackers, getting hold of personal information from 181,604 Medicaid and CHIP (Children’s Health Insurance Plan) records. It was initially revealed that there were only 24,000 individuals compromised but it was later revealed that there were 24,000 files, some of which containing data belonging to hundreds of people. Information includes client names, addresses, birth dates, Social Security numbers, physician’s names, national provider identifiers, addresses, tax identification numbers, and procedure codes designed for billing purposes. Utah IT director Stephen Fletcher was fired because of the incident.

“We understand clients are worried about who may have accessed their personal information, and that many of them feel violated by having their information compromised,” said Michael Hales, deputy director of the Health Department. “But we also hope they understand we are doing everything we can to protect them from further harm.”

While there are actual breaches, there are also rumors. Diablo 3 players in forums are worried that their personal account will be hacked, and have their gold and items stolen. Activision-Blizzard clarified that their servers have never been breached and that reports of personal account compromise have been very small.

Apart from cyber breaches, a report from network security firm FireEye reveals that even hackers need a break from their ill-doings. They prefer attacking on Tuesday and Wednesday, and rest during Saturday and Sunday. Activity level during midweek dwarfs that of other days by 4 times.

“It seems these attackers don’t like to work on weekends, either. Monday’s attack level is at average, while the midweek spike tapers off to below average levels by Friday,” FireEye said in the blog post.


A message from John Furrier, co-founder of SiliconANGLE:

Support our mission to keep content open and free by engaging with theCUBE community. Join theCUBE’s Alumni Trust Network, where technology leaders connect, share intelligence and create opportunities.

  • 15M+ viewers of theCUBE videos, powering conversations across AI, cloud, cybersecurity and more
  • 11.4k+ theCUBE alumni — Connect with more than 11,400 tech and business leaders shaping the future through a unique trusted-based network.
About SiliconANGLE Media
SiliconANGLE Media is a recognized leader in digital media innovation, uniting breakthrough technology, strategic insights and real-time audience engagement. As the parent company of SiliconANGLE, theCUBE Network, theCUBE Research, CUBE365, theCUBE AI and theCUBE SuperStudios — with flagship locations in Silicon Valley and the New York Stock Exchange — SiliconANGLE Media operates at the intersection of media, technology and AI.

Founded by tech visionaries John Furrier and Dave Vellante, SiliconANGLE Media has built a dynamic ecosystem of industry-leading digital media brands that reach 15+ million elite tech professionals. Our new proprietary theCUBE AI Video Cloud is breaking ground in audience interaction, leveraging theCUBEai.com neural network to help technology companies make data-driven decisions and stay at the forefront of industry conversations.