STE WILLIAMS

Lush website hack ‘exposes credit card details’

Luxury cosmetics firm Lush has ditched its UK website in response to a sustained hacking attack which left users vulnerable to credit card fraud.

The firm warns that credit card details submitted to the Lush.co.uk site between 4 October and 20 January may have been compromised by the assault by unknown hackers. Customers are advised to contact their bank as a precaution.

Lush wrote to its customers about the problem via email, copies of which were forwarded to us by several Reg readers. One reader reports that the credit card of a friend who had bought goods from Lush was subsequently used in a failed attempt to fraudulently purchase electrical goods online, anecdotal evidence that suggests the risk of fraud arising from this breach is far from theoretical.

E-commerce outlets sometimes suspend their website upon the discovery of a security compromise, restoring them once it’s decided that underlying problems that might have allowed an attack have been fixed. Lush has gone much further than this and decided to “completely retire” the present version of its website.

“Our website has been the victim of hackers,” a statement on Lush’s soon-to-be-abandoned website explains. “We refuse to put our customers at risk of another entry – so have decided to completely retire this version of our website.”

The cosmetics retailer plans to launch a completely new website, one that initially at least will only accept PayPal payments.

Lush’s shops and mail order systems, run separately and not affected by the hack, will continue to trade as normal. UK-based Lush maintains multiple country specific websites throughout Europe, the US and parts of Asia. All appear to be trading as normal.

A quirky statement on Lush’s UK website, which links to a video ad promoting Lush and featuring glove puppets, concludes with a message to the unknown hackers. “If you are reading this, our web team would like to say that your talents are formidable. We would like to offer you a job – were it not for the fact that your morals are clearly not compatible with ours or our customers,” it said.

Lush’s website statement leaves plenty of questions unanswered, not least how many records were exposed by the attack and what went wrong with its UK site. The continued operation of multiple country-specific sites by Lush sits oddly with its decision to ditch, rather than just suspend, its UK site.

A spokeswoman said that Lush was in the process of putting together an updated statement on the incident, which we await with interest. She declined to answer our questions on how many records might have been exposed

  • 21/01/2011
  • adm

EU climate exchange website hit by green-hat hacker

An EU Climate Exchange website was hacked as part of a political protest against carbon credits by a green-hat defacement crew.

The front page of the ECX.eu website was sprayed with digital graffiti lampooning the concept of applying a market-based approach to tackling carbon emissions. An anonymous group of hacktivists called Decocidio claimed responsibility for the attack, which took place late on Friday.

The hack highlighted the group’s opposition to carbon trading as a means of tackling climate change, and contained links to activist groups Earth First, Climate Justice Action, and the Hack Block as well as an embedded video called The Story of Cap and Trade. Archived copies of the defacement, which carried the headline Super Promo – Climate for sale, can be found here, on a blog maintained by former TV meteorologist Anthony Watts.

The defacement was purged over the weekend and the ECX.eu was restored to normal operation by Monday morning.

IndyMedia Australia has more on the background and motivations of the hack’s perps here. Decocidio preposterously describes its attack as a public act of digital direct action.

Doubtless, as we speak, the perps are camped out in Epping Forest eating lentils and listening to 80s anarcho-vegitarian agitpop from the likes of Crass or Flux of Pink Indians.

Netcraft reports the Climax Exchange website runs Apache on Linux. It’s unclear how the attack was carried out or whether any deeper compromise into databases or other sensitive information was achieved. The vast majority of website defacements do not coincide with deeper breaches.

Attacks against climate change or research websites carry an extra political weight, especially after the CRU breach last year.

A hack against University of East Anglia last November resulted in the exposure of emails and other documents from staff at its Climate Research Unit online. The so-called Climategate breach resulted in a huge political controversy over the methodology of the scientists, with researchers on either side of the climate change debate using extracts from the documents to back up their positions

  • 21/01/2011
  • adm

10Million Website Accounts Breached

A website that helps drivers avoid speeding tickets is warning its 10 million registered users that their email addresses and passwords may be in the hands of hackers who breached the site’s security.

The advisory was issued on Thursday by Trapster, which boasts more than 10 million users on its front page. The site uses crowd-sourcing techniques to compile locations of police who are using radar to catch speeding drivers.

Trapster said the hack amounted to a “single event,” and that the company has since taken steps to “prevent this type of attack from happening again, and continue to implement additional security measures to further protect your data.” Trapster didn’t say whether it planned to begin hashing passwords, which is considered a basic security precaution to prevent their disclosure.

Trapster’s gaffe comes a little more than a month after hackers rooted Gawker Media servers and made off with some 1.5 million user passwords and corresponding email addresses. After a file containing the booty was posted online, many users of Twitter, Facebook, and other popular websites reported a spike in account breaches, indicating the sad fact that some folks can’t be bothered to use a unique password for different sites.

This fact hasn’t been lost on the security team at Twitter, which warned Trapster users to change their passwords shortly after Thursday’s advisory was released.

  • 21/01/2011
  • adm

DUP website translated into Irish by mischievous hacktivist

A mischievous hacktivist broke into three websites run by the Democratic Unionist Party on Wednesday night to replace the website of the staunchly unionist Ulster party with an Irish language version.

Party leader Peter Robinson’s welcome message to the site was translated into Irish and appended to include support of the “Irish Language Act”, the BBC reports.

In reality, the DUP has repeatedly blocked the introduction of the proposed law, which is backed by nationalist majority party Sinn Fein.

The hacker, who rejoices in the Joycean moniker of Hector O’Hackatdawn @HectorOHackAtD), also defaced the websites of party bigwigs peterrobinson.org and jeffreydonaldson.org. (more…)

  • 14/01/2011
  • adm