Hackers Hack Hackers’ Site

Information leak site Cryptome.org was infected with the Blackhole exploit kit earlier this month, according to documents posted on the site. The site posts a wide range of leaked documents and open source intelligence. It had its entire contents modified to install the Blackhole exploit kit. The site was attacked before, in 2010, after it published documents critical of Wikileaks and its founder, Julian Assange.

Valves says hackers likely stole user data: Valve told users of Steam, the online game distribution platform, hackers have likely downloaded encrypted credit card transaction data during an intrusion last year. In November, the company said  hackers gained unauthorized access to Steam’s user database but that there was no evidence to suggest a leak of encrypted credit card details. However, Friday the company sent an email to users saying, “Recently we learned that it is probable that the intruders obtained a copy of a backup file with information about Steam transactions between 2004 and 2008.” The backup file contained Steam user names, email addresses, encrypted credit card details and encrypted billing addresses, but no account passwords.

Safety flaw found in public encryption keys: Nearly four in every thousand public encryption keys used for online services such as banking, email and shopping, offer no security for users. Researchers in the U.S. and Europe discovered that a flaw in the process for generating random prime numbers – a critical component of the public key encryption – resulted in thousands of public keys sharing common prime numbers.

Information stealers and pay-per-install are fastest growing malware threats: According to a report by the security firm FireEye that the fastest growing malware categories in the second half of 2011 were PPI (Pay-Per-Installs) and information stealers that target user credentials enabling the theft of key intellectual property and sensitive data.  PPIs charge a fee to download or distribute other malware programs. They differ from normal downloaders/droppers because PPI malware author gets paid for every successful install of another malware program. Of the top four malware categories, information stealers and backdoors present the greatest threat to enterprises.