How the Syrian Electronic Army Hacked The Onion - Onion Inc.'s Tech Blog

QUOTE from link above:

.........At this point the editorial staff began publishing articles inspired by the attack. The second article, Syrian Electronic Army Has A Little Fun Before Inevitable Upcoming Deaths At Hands Of Rebels, angered the attacker who then began posting editorial emails on their Twitter account. Once we discovered this, we decided that we could not know for sure which accounts had been compromised and forced a password reset on every staff member’s Google Apps account.

In total, the attacker compromised at least 5 accounts. The attacker logged in to compromised accounts from 46.17.103.125 which is also where the SEA hosts a website.

Under the above heading are some suggestions to avoid this type of attack...

QUOTE from link above:

"Hotmail was still one of the most widely used services, with over 300 million active accounts," he wrote. "This made the magnitude of the process incredible, maybe even unprecedented. This meant communicating with hundreds of millions of people, upgrading all their mailboxes and making sure that every person's mail, calendar, contacts, folders, and personal preferences were preserved in the upgrade. Of course, this had to be done with a live site experience that was handling billions of transactions a day."

So, farewell Hotmail, which almost certainly had users active on it since its 1996 debut.

ImageDetail

Microsoft just upgraded everyone who uses Hotmail to the new Outlook.com. This required migrating more than 150 petabytes (150 million gigabytes) of data.

 

Java exploits represent a common attack vector used by the bad guys to infiltrate vulnerable computers via the web browser. We wrote about the rise of Java exploits as early as 2010, and we haven't seen that trend decline. In fact, in the first quarter of 2013 alone, we've seen three Java remote code execution vulnerabilities being exploited in the wild: CVE-2013-0422, CVE-2013-0431, and CVE-2013-1493. In response, Oracle recently introduced a new security feature regarding the way unsigned Java applets and web start applications are run in the release of Java 7 update 11. The text in Oracle's release notes reads:

Synopsis: Default Security Level Setting Changed to High.

The default security level for Java applets and web start applications has been increased from "Medium" to "High". This affects the conditions under which unsigned (sandboxed) Java web applications can run. Previously, as long as you had the latest secure Java release installed applets and web start applications would continue to run as always. With the "High" setting the user is always warned before any unsigned application is run to prevent silent exploitation.

The rest is here.....

Microsoft Corporation

Screenshot from http://microsoftportal.net/windows-blue/2037-windows-blue-pozvolit-otklyuchit-startovyy-ekran.html

The others from all the big name carriers such as ATT, Verizon Wireless, Sprint Nextel and T-Mobile USA

are running outdated software including proprietary software and outdated browsers.

More here: ACLU complains to FTC that mobile carriers leave Android phones unsecured | PCWorld

QUOTE from link above: ......

according to the complaint, which has asked the FTC to require the operators to allow users to exchange their Android smartphones that are less than 2 years old for one that receives regular security updates, or return the phone for a full refund of the purchase price, if they have not been receiving regular and prompt security updates.

ACLU also asked the FTC to compel the operators to allow customers using carrier-supplied Android smartphones to cancel contracts without any early termination fees. The operators should also be compelled to warn all subscribers using carrier-supplied Android smartphones with known, unpatched security vulnerabilities..............