Feeds

Ethical hacker backer hacked, warns of email ransack

Switches registrars, tightens security after 'upsetting' incident

Choosing a cloud hosting partner with confidence

The IT security certification body that runs the Certified Ethical Hacker programme has itself been hacked.

The EC-Council said the same hackers who ran the DNS poisoning attack that resulted in the defacement of its website in late February had also managed to access the control panel for its website after breaking into the systems of a third-party registrar. This compromised access allowed the miscreants to circumvent security controls and get into the security organisation's email system, as a breach notice from the EC-Council to its members explains.

EC-Council uses a cloud service provider for enterprise email. Once the domain privilege was attained, the hacker then issued a password reset request to the email service provider. This circumvented EC-Council's best practices of using complex passwords and 2-factor authentication. We have informed the service provider of this password reset policy vulnerability and are hopeful that they have already rectified it for the benefit of the IT community in general.

With administrative access to the email service provider, the hacker was able to compromise a small number of email accounts before the EC-Council security team was able to respond to the breach.This resulted in unauthorized access to messages in those specific email boxes for a short duration of time.

The investigation into the breach is still ongoing and it's unclear which member data, if any, has been exposed. Credit card transactions are run through a different system that wasn't exposed by the attack but any private information sent by email might have been compromised, although this is uncertain.

"As a precautionary measure, we are writing to notify members that have sent any personally identifiable information to EC-Council via email that there is a possibility that these may have been exposed through email," the breach notification from the EC-Council explains. "No credit card data was compromised."

The US-based EC-Council runs the Certified Ethical Hacker programme, C|EH and other certifications. The organisation – whose tagline is Hackers are here. Where are you? – asks members to submit sensitive data such as passport details as part of its registration process. The leak of this data is obviously the main concern raised by the breach.

In response to the incident, the EC-Council has promised to tighten up its security procedures.

The organisation said in a statement on the breach that went out on yesterday:

EC-Council strives to set a very high bar for how they serve their community, and this incident is upsetting. EC-Council has since transferred their domain to another registrar, changed policies on management of personal information, improved existing data retention policies, introduced two-factor authentication for member portals, and improved security procedures and systems. ®

Bootnote

A shout-out to Mark, an infosec contractor going for CEH accreditation, who tipped us off about the EC-Council's breach notification to its members.

Top 5 reasons to deploy VMware with Tegile

More from The Register

next story
Regin: The super-spyware the security industry has been silent about
NSA fingered as likely source of complex malware family
Why did it take antivirus giants YEARS to drill into super-scary Regin? Symantec responds...
FYI this isn't just going to target Windows, Linux and OS X fans
Privacy bods offer GOV SPY VICTIMS a FREE SPYWARE SNIFFER
Looks for gov malware that evades most antivirus
Patch NOW! Microsoft slings emergency bug fix at Windows admins
Vulnerability promotes lusers to domain overlords ... oops
HACKERS can DELETE SURVEILLANCE DVRS remotely – report
Hikvision devices wide open to hacking, claim securobods
'Regin': The 'New Stuxnet' spook-grade SOFTWARE WEAPON described
'A degree of technical competence rarely seen'
Astro-boffins start opening universe simulation data
Got a supercomputer? Want to simulate a universe? Here you go
You stupid BRICK! PCs running Avast AV can't handle Windows fixes
Fix issued, fingers pointed, forums in flames
prev story

Whitepapers

Designing and building an open ITOA architecture
Learn about a new IT data taxonomy defined by the four data sources of IT visibility: wire, machine, agent, and synthetic data sets.
Why CIOs should rethink endpoint data protection in the age of mobility
Assessing trends in data protection, specifically with respect to mobile devices, BYOD, and remote employees.
Getting started with customer-focused identity management
Learn why identity is a fundamental requirement to digital growth, and how without it there is no way to identify and engage customers in a meaningful way.
High Performance for All
While HPC is not new, it has traditionally been seen as a specialist area – is it now geared up to meet more mainstream requirements?
Security and trust: The backbone of doing business over the internet
Explores the current state of website security and the contributions Symantec is making to help organizations protect critical data and build trust with customers.