STE WILLIAMS

Hong Kong Stock Exchange Hacked

Hackers took down a website belonging to the Hong Kong stock Exchange, prompting Asia’s third-largest securities exchange to suspend trading in the shares of London-based HSBC and six other companies.

“Our current assessment is that this is the result of a malicious attack by outside hacking,” HKEx Chief Executive Charles Li, said, according to The Financial Times. Li added it was unclear who the hackers were or what they hoped to gain from their actions.

“We’re digging into that particular question right now,” he said.

The attack crashed a website that locally listed companies used to announce price sensitive news, the FT reported. HKEx responded by suspending trading of seven companies that were scheduled to make announcements during the lunch break. Among them was HSBC, which on Wednesday confirmed the sale of its US credit card business and retail services unit to Capital One Financial. Trading was also suspended for stocks of China Power International, Cathay Pacific, and HKEx itself.

HKEx is at least the second major exchange to be targeted by hackers this year. In February, Nasdaq admitted attackers planted malware on one of its portals. Nasdaq was quick to say that none of its trading systems were affected and no customer information had been accessed. HKEx officials gave almost identical assurances on Wednesday.

After the HKEx website came down, officials instructed market participants to use an older bulletin board to obtain announcements being released by listed companies. If the website isn’t restored by market opening on Thursday, the stock exchange plans to rely on the legacy system again, but has no plans to suspend trading of any shares.

Additional coverage is here and here.

SOURCE

  • 11/08/2011
  • adm

UC Gov Gmail Phishers Stalked Victims for Months

Spear phishers who targeted the personal Gmail accounts of senior government officials painstakingly monitored incoming and outgoing email for almost a year, a researcher who helped uncover the campaign said.

In some cases, the attackers sent the victims emails designed to originate from friends or colleagues in hopes of getting responses that detailed the targets’ schedules, contacts, and job responsibilities, Mila Parkour, a Washington, DC-based system administrator who does security research on the side, told The Register. The attackers also employed web-based scripts that caused earlier versions of Microsoft’s Internet Explorer browser to divulge detailed information about the software used by the compromised account holder. (more…)

  • 03/06/2011
  • adm

Leaked US cables finger Chinese army hackers for cyber-spying

Leaked US diplomatic cables have provided some of the first hard evidence that the US is engaged in a heated cyberespionage battle with China, a conflict diplomats reckon is showing few signs of cooling off.

Diplomatic cables, obtained by WikiLeaks and released to the media by a third party last week, trace a series of breaches codenamed Byzantine Hades back to a specific unit of China’s People’s Liberation Army.

Websites associated with attacks dating back to 2006 were registered using the same postal code in the central Chinese town of Chengdu that is used by the People’s Liberation Army Chengdu Province First Technical Reconnaissance Bureau (TRB), an electronic espionage unit.

At least six such bureaus, including the Chengdu unit, “are likely focused on defines or exploitation of foreign networks”, according to a report by officials in the State Department’s Cyber Threat Analysis Division and quoted in the leaked cable, which was written in April 2009.

The Byzantine Hades attacks, which ran from 2006 through till at least October 2008 – and are possibly still ongoing – used targeted emails that attempted to trick recipients into opening booby-trapped attachments. Common malware payloads involved the so-called Gh0stNet Remote Access Tool (RAT), a strain of malware capable of capturing keystrokes, taking screen shots, installing and changing files, and even surreptitiously recording conversations before uploading them to a remote server, Reuters reports.

Servers used in the exercise were the same as those previously linked to attacks on Tibetan websites around the time of the Beijing Olympics in 2008.

The cable reports claim that a Shanghai-based hacker group linked to the People’s Liberation Army’s Third Department was involved in the assaults. The leaked cable names a hacker named Yinan Peng from a group called Javaphile as among those involved in the assaults.

Both US government agencies and private sector firms became victims of the attacks.

Hackers successfully swiped “50 megabytes of email messages and attached documents, as well as a complete list of usernames and passwords from an unspecified [US government] agency,” the cable said.

Other targets of the assaults include the US Embassy in Tokyo, Japan. The cable quotes a meeting at the Ramstein Air Base in September 2008 when German and French officials told their US opposite numbers that they had also been hit by cyber-espionage attacks.

The leaked cable was written months before China went public over hack attacks against the US search giant and other high-tech firms that were creating diplomatic tension between the US and China. The cable speaks of a series of diplomatic meetings between US and Chinese officials. US diplomats seem fairly sure that the Chinese are behind the attacks, whose main motive seems to be to steal trade secrets that might be used to sustain China’s economic growth. The talks reportedly remain ongoing, even though progress remains slow.

Chinese officials are seemingly happy enough to assure the US that they have no interest in destabilising the US economy – as a major stockholder such actions would be counterproductive – but clam up when talk turns to cyber-espionage. Senior figures in the government, when pressed on the issue, are inclined to state that China is being spied upon more than it is spying on others

  • 19/04/2011
  • adm

Chinese crack down on ‘money-sucker’ Androids

The Chinese government is to crack down on “money sucking” mobiles: Android-based handsets that subsidise themselves by stealing from the customer’s account.

The crackdown aims to involve network operators, target retailers and ensure that selling handsets featuring pre-installed Trojans is explicitly illegal, according to the Google translation.

The idea is to set up a central unit to manage complaints, though it seems the scam has been going on long enough to build up considerable momentum.

The handsets concerned are sold cheaply, and generally unbranded, though some bear forged logos. Once they go into use the Android-based handsets start quietly sending text messages, or making a silent call or two. The transactions only incur a fee of about around 20 pence a time, in the hope the user will never notice, while the miscreant collects the termination fee or other premium charge. (more…)

  • 14/01/2011
  • adm