Question

Read three recent news articles about passwords and write a brief summary. Include a reference to each article.

Answer 1

The Latest Facebook Password Leak: Hundreds of Millions of User Passwords Exposed to Company Employees

The security lapse consists of a database of hundreds of millions of plain text user passwords, widely accessible to Facebook staff. It is estimated that around 20,000 company employees had access to the Facebook password leak, but the whistle blower enclosed data indicating that about 2,000 Facebook employees have run about nine million queries on the database since it first appeared in 2012. The company claims that employees no longer have access to this database. The information was leaked to Brian Krebs on March 21 by an anonymous source claiming to be a Facebook employee.The internal investigation of the Facebook password leak is still ongoing, but right now the company is estimating that up to about one-quarter of its user base potentially had their passwords exposed in the database. The company has opted to notify hundreds of millions of affected users individually rather than implement a site-wide forced password reset.  

https://www.cpomagazine.com/data-protection/the-latest-facebook-password-leak-hundreds-of-millions-of-user-passwords-exposed-to-company-employees/

Asus Engineers Exposed Company Passwords for Months on GitHub

Earlier this week, Kaspersky Labs and Symantec both publicly stated that a major security breach at Asus had put the company’s customers at risk. According to Kaspersky Labs, up to a million systems might have been infected by a hacked version of Asus’ LiveUpdate software, as part of a goal of targeting ~600 very specific users by MAC address. Asus has released a statement on the attacks, confirming the assault was classified as an APT (Advanced Persistent Threat), a type of attack typically deployed by nation-states or potentially in corporate espionage rather than by ordinary hackers. A security analyst that goes by SchizoDuckie contacted Techcrunch to share details of a security breach he discovered in Asus’ human firewall. According to him, Asus was improperly publishing its own employee passwords in repositories on GitHub. He was able to access internal company email as a result where nightly builds of apps, drivers, and tools were shared. The account was owned by an engineer who had reportedly left it open for at least a year. TC reports that SchizoDuckie shared screenshots to validate his findings, though they haven’t been released.

https://www.extremetech.com/internet/288591-asus-engineers-exposed-company-passwords-for-months-on-github

Massive Citrix Data Breach Thought to be the Work of Iranian Hackers

Cloud computing giant Citrix is the latest big name to fall victim to a major data breach. The Florida-based company was hit for an estimated six to ten terabytes of confidential internal information in early March. While any data breach of this size is a legitimate news item, the Citrix data breach is particularly noteworthy as the software company provides cloud services to the U.S. military through its Shared Services Center and is one of the Department of Defense’s approved vendors. The Citrix data breach is thought to have been perpetrated by Iranian hackers in a group called IRIDIUM, which is believed to have ties to the country’s government. These international cyber criminals specialize in attacking foreign nations, aiming at the confidential information of government agencies and major players in the economy. They have been active for over a decade and have hit at least 200 organizations during that time.

https://www.cpomagazine.com/cyber-security/massive-citrix-data-breach-thought-to-be-the-work-of-iranian-hackers/