Feeds

Attacker steals ‘old passwords’ from Oz defence academy site

Security fail sparks usual hypegasm

SANS - Survey on application security programs

An attack on Australian Defence Force Academy systems operated by the University of New South Wales (UNSW), has spilled 20,000 user records.

The systems were compromised in November, with UNSW notifying staff and students within a day, but has only now come to light.

The attacker, whose “Darwinaire” tag was also seen in a claimed attack on Amazon UK in early November, says the Website took only minutes to reveal its secrets, according to the Sydney Morning Herald (of course, an attacker’s statements about their own prowess may be considered equivocal).

In an e-mail sent to students and staff, posted here, UNSW says it expected the impact of the attack to be “minimal”, explaining that some IDs and passwords were “historical” and others related to a system that has since been replaced.

However, since e-mail addresses can easily be inferred from user names, the university warned that users may receive targeted spam or phishing attacks, or that the names may be used to attempt identity theft.

The attack has spawned national “hack attack” paranoia as a “national security failure” (according to RMIT’s Dr Mark Gregory speaking to The Conversation) and the SMH headlining the attack as “Australia’s worst hacking attack”.

While the publication of 20,000 user IDs has to be regarded as embarrassing, previous attacks known to Vulture South have sent target companies to the wall, going back as far as the 1990s. A more measured assessment of the attack has been penned by Sophos’ Paul Ducklin here, who notes that while the breach is serious, “no juicy Defence secrets” were involved.

Vulture South is also curious as to why the ADFA systems held 20,000 user IDs, when the academy’s annual intake numbers in the hundreds. We will update this story should ADFA respond to our query. ®

High performance access to file storage

More from The Register

next story
Obama allows NSA to exploit 0-days: report
If the spooks say they need it, they get it
Putin tells Snowden: Russia conducts no US-style mass surveillance
Gov't is too broke for that, Russian prez says
Snowden-inspired crypto-email service Lavaboom launches
German service pays tribute to Lavabit
Mounties always get their man: Heartbleed 'hacker', 19, CUFFED
Canadian teen accused of raiding tax computers using OpenSSL bug
Heartbleed exploit, inoculation, both released
File under 'this is going to hurt you more than it hurts me'
Arts and crafts store Michaels says 3 million credit cards exposed in breach
Meanwhile, Target investigators prepare for long process in nabbing hackers
Canadian taxman says hundreds pierced by Heartbleed SSL skewer
900 social insurance numbers nicked, says revenue watchman
prev story

Whitepapers

SANS - Survey on application security programs
In this whitepaper learn about the state of application security programs and practices of 488 surveyed respondents, and discover how mature and effective these programs are.
Combat fraud and increase customer satisfaction
Based on their experience using HP ArcSight Enterprise Security Manager for IT security operations, Finansbank moved to HP ArcSight ESM for fraud management.
The benefits of software based PBX
Why you should break free from your proprietary PBX and how to leverage your existing server hardware.
Top three mobile application threats
Learn about three of the top mobile application security threats facing businesses today and recommendations on how to mitigate the risk.
3 Big data security analytics techniques
Applying these Big Data security analytics techniques can help you make your business safer by detecting attacks early, before significant damage is done.