09/26/2012

privacycommission and belgian parliamentarian want Belgian breach notification law after Rex Mundi announcement

After the announcement of the hack of a Belgian firm with half a million members by rex mundi on twitter last week the privacycommission and the Belgian parliament are coming into action

tired of waiting on the valuable but heavily counterlobbied effort by the European Commission for an European Data Breach Notification Directive - of which rumours say that it could take 2 to 6 years to implement - some Belgian Parliamentarians like Roel Deseyn want now to implement Belgian law that later can be adapted to the European Directive if necessary.

the hack of a database of half a million belgians of which only a few people now what really happened (I don't know what really happened) may be the trigger to get the Belgian parliament and the government maybe moving very fast

half a million data is off course a 'big one', the one that would lead to chaos if half a million people would have to change their password, sometimes their emailaddress, telephone numbers and so on

the question is if we are prepared to treat a 'big one' just as we prepare for a big nuclear disaster, a food crisis, a big fire or accident and what if we have a big data leakage, who will be responsable

Permalink | |  Print |  Facebook | | | | Pin it! |

IEEE is breached and a hacker has all the 100.000 passwords

IEEE suffered a data breach which I discovered on September 18 (UPDATE: the breach is now confirmed). For a few days I was uncertain what to do with the information and the data. On September 24, I let them know, and they fixed (at least partially) the problem. The usernames and passwords kept in plaintext were publicly available on their FTP server for at least one month prior to my discovery. Among the almost 100,000 compromised users are Apple, Google, IBM, Oracle and Samsung employees, as well as researchers from NASA, Stanford and many other places. I did not and will not make the raw data available to anyone else.
http://ieeelog.com

so what does this say

that they left the logins (login and password) unencrypted in the logs of the access to the site and didn't hash the logs or stock them away somewhere else to archive

that European and American privacyregulations and laws have been breached

that someone has the files on his or her computer and nobody can guarantee what he will or won't do with them

the passwords give access to researchers all over the world of the biggest military, scientific and industrial networks

in those networks, researchers are the ones that are the least preoccupied with security (free flow of information and all that)

Permalink | |  Print |  Facebook | | | | Pin it! |

Oplichtingsemails voor ING (banken sturen niet dergelijke emails - hoop ik)


Veiligheidsupdate Home Banking / ING

Marnixlaan 24, 1000 Brussel - 26-09-2012

Sinds woensdag 25 Augustus 2012 werken wij met een nieuw beveiligingssysteem.

Dit nieuwe systeem zorgt ervoor dat er geen misbruik kan worden gemaakt van uw rekening door bijvoorbeeld kwaadwillende software of een virus dat zich ongemerkt op uw computer heeft geïnstalleerd.

Om ervoor te zorgen dat ook uw rekening wordt beveiligd door ons nieuw systeem,

verzoeken wij u hieronder eenmalig de hyperlink te volgen om vervolgens uw gegevens te verifiëren.

Zodra u dit heeft gedaan, zullen wij contact met u opnemen en stappen doornemen om uw account te updaten met onze nieuwe beveiligingssoftware.

Klik hier om uw gegevens te verifiëren

Bedankt voor uw medewerking

Met vriendelijke groet,



ING België

Permalink | |  Print |  Facebook | | | | Pin it! |

09/21/2012

European Commission abuses online antiterrorism to propose to control everything from all of us (leaked document)

A leaked document from the CleanIT project shows just how far internal discussions in that initiative have drifted away from its publicly stated aims, as well as the most fundamental legal rules that underpin European democracy and the rule of law.

The European Commission-funded CleanIT project claims that it wants to fight terrorism through voluntary self-regulatory measures that defends the rule of law.

The initial meetings of the initiative, with their directionless and ill-informed discussions about doing “something” to solve unidentified online “terrorist” problems were mainly attended by filtering companies, who saw an interesting business opportunity. Their work has paid off, with numerous proposals for filtering by companies and governments, proposals for liability in case sufficiently intrusive filtering is not used, and calls for increased funding by governments of new filtering technologies.

The leaked document contradicts a letter sent from CleanIT Coordinator But Klaasen to Dutch NGO Bits of Freedom in April of this year, which explained that the project would first identify problems before making policy proposals. The promise to defend the rule of law has been abandoned. There appears never to have been a plan to identify a specific problem to be solved – instead the initiative has become little more than a protection racket (use filtering or be held liable for terrorist offences) for the online security industry.

The proposals urge Internet companies to ban unwelcome activity through their terms of service, but advise that these “should not be very detailed”. This already widespread approach results, for example, in Microsoft (as a wholly typical example of current industry practice) having terms of service that would ban pictures of the always trouserless Donald Duck as potential pornography (“depicts nudity of any sort ... in non-human forms such as cartoons”). The leaked paper also contradicts the assertion in the letter that the project “does not aim to restrict behaviour that is not forbidden by law” - the whole point of prohibiting content in terms of service that is theoretically prohibited by law, is to permit extra-judicial vigilantism by private companies, otherwise the democratically justified law would be enough. Worse, the only way for a company to be sure of banning everything that is banned by law, is to use terms that are more broad, less well defined and less predictable than real law.

Moving still further into the realm of the absurd, the leaked document proposes the use of terms of service to remove content “which is fully legal”... although this is up to the “ethical or business” priorities of the company in question what they remove. In other words, if Donald Duck is displeasing to the police, they would welcome, but don't explicitly demand, ISPs banning his behaviour in their terms of service. Cooperative ISPs would then be rewarded by being prioritised in state-funded calls for tender.

CleanIT (terrorism), financed by DG Home Affairs of the European Commission is duplicating much of the work of the CEO Coalition (child protection), which is financed by DG Communications Networks of the European Commission. Both are, independently and without coordination, developing policies on issues such as reporting buttons and flagging of possibly illegal material. Both CleanIT and the CEO Coalition are duplicating each other's work on creating “voluntary” rules for notification and removal of possibly illegal content and are jointly duplicating the evidence-based policy work being done by DG Internal Market of the European Commission, which recently completed a consultation on this subject. Both have also been discussing upload filtering, to monitor all content being put online by European citizens.

CleanIT wants binding engagements from internet companies to carry out surveillance, to block and to filter (albeit only at “end user” - meaning local network - level). It wants a network of trusted online informants and, contrary to everything that they have ever said, they also want new, stricter legislation from Member States.

Unsurprisingly, in EDRi's discussions with both law enforcement agencies and industry about CleanIT, the word that appears with most frequency is “incompetence”.

The document linked below is distributed to participants on a “need to know” basis – we are sharing the document because citizens need to know what is being proposed.

Key measures being proposed:

  • Removal of any legislation preventing filtering/surveillance of employees' Internet connections
  • Law enforcement authorities should be able to have content removed “without following the more labour-intensive and formal procedures for 'notice and action'”
  • “Knowingly” providing links to “terrorist content” (the draft does not refer to content which has been ruled to be illegal by a court, but undefined “terrorist content” in general) will be an offence “just like” the terrorist
  • Legal underpinning of “real name” rules to prevent anonymous use of online services
  • ISPs to be held liable for not making “reasonable” efforts to use technological surveillance to identify (undefined) “terrorist” use of the Internet
  • Companies providing end-user filtering systems and their customers should be liable for failing to report “illegal” activity identified by the filter
  • Customers should also be held liable for “knowingly” sending a report of content which is not illegal
  • Governments should use the helpfulness of ISPs as a criterion for awarding public contracts
  • The proposal on blocking lists contradict each other, on the one hand providing comprehensive details for each piece of illegal content and judicial references, but then saying that the owner can appeal (although if there was already a judicial ruling, the legal process would already have been at an end) and that filtering such be based on the “output” of the proposed content regulation body, the “European Advisory Foundation”
  • Blocking or “warning” systems should be implemented by social media platforms – somehow it will be both illegal to provide (undefined) “Internet services” to “terrorist persons” and legal to knowingly provide access to illegal content, while “warning” the end-user that they are accessing illegal content
  • The anonymity of individuals reporting (possibly) illegal content must be preserved... yet their IP address must be logged to permit them to be prosecuted if it is suspected that they are reporting legal content deliberately and to permit reliable informants' reports to be processed more quickly
  • Companies should implement upload filters to monitor uploaded content to make sure that content that is removed – or content that is similar to what is removed – is not re-uploaded
  • It proposes that content should not be removed in all cases but “blocked” (i.e. make inaccessible by the hosting provider – not “blocked” in the access provider sense) and, in other cases, left available online but with the domain name removed.

http://www.edri.org/cleanIT  (leaked documents)

Permalink | |  Print |  Facebook | | | | Pin it! |

09/20/2012

My take on Anonymous and Lulzsec

it seems I have to clarify or repeat this

1. THere is no one Anonymous, Anonymous is a platform, a shouting name for a whole bunch of different groups, individuals, causes and actions with their own agenda but who would never get the same attention if they did it on their own, so in this way every activist is in some part Anonymous but at the same time he or she is not part of all the different actions that are done in name of Anonymous. But that doesn't make them hackers.

2. Anonymous has a crappy ideology. This is what I said from the beginning. We are not one and united, we are all different and we have all different ideas, objectives and strategies and methods. So saying that we are one doesn't wash all these differences away. I like the Occupy movement more than Anonymous because it is more ideological and more clear. But that doesn't make me a hacker.

3. Anonymous is evolving and changing all the time. If you see for example how Lulzsec (a police operation in the end) and Anonymous moved (or the discussion about the black block) than you can't stay that their relationship was clear and permanent. If you want to continue to understand the movement in movement, you have to continue to follow it up.

4. I am an activist for the cybercauses so I follow them and a lot of other causes and as a newsjunkie I rassemble data, links, information and publications

5. Also it is sometimes too much hype and boasting about itself and it sometimes loses all sense of critical thinking, just storming forward like a mob or a bunch of herds

I don't need Anonymous here. I don't see the need for Anonymous here. I don't approve of the hacking by the Belgian Anonymous (the factory is still being planned to close)

What we do need in reality is less hype about Anonymous and more digital actions about privacy, security and liberty in our Belgian society and on the web.

Permalink | |  Print |  Facebook | | | | Pin it! |

10 reasons why I am not a hacker

1. I have a life, a family, a home and a career (sort of)

2. I hate prisons even if I haven't been in them

3. I believe that hacking in or from Belgium is very risky, most of Belgian hackers have been arrested after a while

4. I don't have to hack to proof my point that the belgian web is insecure, others show it every day

5. I want to protect the innocent and ridiculize the stupid who think that they may get away with their crappy security (publicizing their hacked websites does this)

6. I don't believe it will change anything, if you want to change the securitysituation in Belgium you have to change  the laws (see responsable disclosure for example). I have done that in the past.

7. There is no responsable disclosure in Belgium so even with securityresearch you have to be very careful

8. I have the trust of a whole lot of people and I don't want to shame them

9. I am working on some new securityprojects that may change the securitysituation in Belgium very fast and these are more important than some demonstration

10. I like the internet too much to be able to enjoy life as much without it

Permalink | |  Print |  Facebook | | | | Pin it! |

website mayor Brugge Moenaert hacked

http://www.patrickmoenaert.be/index.html

Code The Arts

İ Love Mercedes :)

Hacked By ZiyaretCi

 

JeOPaRDY - Nettoxic - Powerdream - Xarnuz - BuzuLL - Shekkolik

http://www.zone-h.org/mirror/id/18371653

Permalink | |  Print |  Facebook | | | | Pin it! |

09/19/2012

active in an election - so except from this kind of operation like today

it is going to be less stress here

happy that we solved something today

even if it is not our job

but if we don't do it

to protect the innocent

who will

Permalink | |  Print |  Facebook | | | | Pin it! |

doing the right thing is responsable disclosure

don't hurt the innocent bystanders who are the individuals who trusted the blablabla marketing and supposed that they were secure even if the online service provider didn't give a shit responsable disclosure is informing the cert and for the cert to set things up to make that possible Lulzsec is fine, but keep the lulz for the fat cats not the mouse that we are

thanks rex mundi (if you are right of course, which is now for the cert to find out)

Permalink | |  Print |  Facebook | | | | Pin it! |

rex mundi extends the release of the data till next week, but doesn't give a clue yet

Anyway, we won't release data on Fri. Just announce the leak. Data will b posted next week if no money is received.

Permalink | |  Print |  Facebook | | | | Pin it! |

rex mundi, the blackmailed belgian firm and the rest of us

rex mundi says

We will not publish the data. If they pay us in time.

Permalink | |  Print |  Facebook | | | | Pin it! |

rex mundi and why he shouldn't leak the half a million accounts on friday

On Friday, details about our new target. A MUCH larger company, this time. Actually, our biggest op so far.

 

 

 

In other words, Webassur case is closed. We promised the Webassur DB. U can use the passwords in leak to login to their clients' websites.

 

 

Leak for next Friday is a DIFFERENT leak. We have acquired data from a large BE company w/ over 500,000 customer records

-------------------------------------------------------------------------------------------------------------------------

in most of the cases before you asked for money, here I don't say that demand, do you mean it is for honor ?

when firms didn't pay, you didn't always publish which means that some may be a bit skeptical about the possibility that you have them - which you could see as a provocation  because sometimes you did publish data (or parts of it) and sometimes some other geezers tried to grab the headlines with stupid tricks and big declarations without delivering

if it is for honor than you wouldn't need to publish them, you can publish the name of the company and a cleaned sample of data that is easy to recognize as data from that firm (do never publish RRN or rijksregisternumbers nor SIS numbers pls), you would still be the hacker of that firm and the firm will still publicly be slashed for its insecurity but there would be a big difference. You wouldn't be - in the eyes of the media, people and history - be a leaker or chaotic hacker but a 'responsable leaker' (like responsable disclosure)

you would get more respect - now and in the hackers history - than you would ever get with any other act that you have done so far (and still make the online world news if that is important to you)

and if you don't want to do the responsable thing of not publishing them (do not harm the innocent) than there is plenty of other information that could be used to file a complaint against the firm and than we could use this case to make the case for more cycersecurity

so it is up to you and you alone what you do

I am sure there are ways with secret passwords or some file or technical info and so on to get a sample or more information

you should at least give the cert and the other cyberdefenders the time to prepare for this if you are going to release this file (supposing you have it) Do you imagine what it would cost just to email half a million people that there passwords are published and that they would have to change their passwords anywhere where they uses the same ones ? And that would be just one of the things that people like me - trying to protect the innocent and help them through breaches and leakages - do. This is too big not to think twice again.

and yes the firm that has such an irresponsable insecurity of its infrastructure and data will get grilled and audited and publicly shamed.

do the right thing

mailforlen@yahoo.com

Permalink | |  Print |  Facebook | | | | Pin it! |

09/18/2012

rex mundi gives more information about the friday belgian insurer leak of thousands of personal info of Belgians

first he didn't have 300 databases, he has hacked 300 websites, this is according to him a big difference

secondly he says that the way he got in is still online and hackable

@mailforlen Just read ur post. We said we hacked 400 websites,not 400DB.. the Modulink backend can b accessed w/ passwords in today's leak.

@mailforlen Well, Tor yourself up and check some of those passwords! They do indeed work. Dummy table? nope.

it is one of the sites on the server of the developer of websites for insurance agents (co-hosting is bullshit if you have personal or confidential data)

@mailforlen Or better, yet. (and legal this time): Call some of the companies listed in our release. PS: You don't wnt 2miss our Friday leak

oh and what about all these other databases they have said they have but they finally didn't publish (of which some belgian)

@mailforlen Finally: We never bluffed. The fact that we didn't publish some of our data doesn't mean that we didn't have it.
 
01:57 PM - 18 Sep 12

this is the declaration

  1. We have been busy little bees this week, hacking our way into over 300 Belgian lending and insurance websites (full list below).
  2. What do all of these websites have in common?
  3. Well, they have all been designed by the same company called Webassur (http://www.webassur.be). The geniuses running this company apparently thought it would be a bold, brave idea to store all of their websites'data into the same SQL database. In other words, once we managed to hack into one of them, we immediately got access to each and every other website designed by Webassur.
  4. The data we stole includes the personal details of each customer of Webassur, along with details about insurance and loan applications made of the websites.
  5. We have offered Webassur not to release this data for the paltry sum of five thousand Euros, but, unfortunately, as of today, they have not complied with our demands.
  6. If someone trusts you with the security of their data, the least you could do, in our opinion, is to man up if your server gets breached and pay up.
  7. Webassur has until next Monday to pay us. If not, well, their customers' data will end up on the Internet, just like Credipret's and AmeriCash Advance's.

This is the list of firms that had confidence in webassur and is now on the hitlist

http://pastebin.com/rtt7QdyV

  1. www.zakenkantoorvangoethem.be
  2. www.janmakelaar.be
  3. www.remaut-verzekeringen.be
  4. www.ivoreggers.be
  5. www.besteverzekering.be
  6. www.vandenostende.be
  7. www.miel-dewals.be
  8. www.verstraete-vantomme.be
  9. www.alfa-verzekeringsmakelaars.be
  10. www.financecare.be
  11. www.a-groep.be
  12. www.verzekeringen-torfs.be
  13. www.huyghebaert.be
  14. www.vandaele-nv.be
  15. www.verzekeringenvandenbulcke.be
  16. www.kindermans-kantoor.be
  17. www.oelegem.be
  18. www.oraconsulting.be
  19. www.poperings-verzekeringsburo.be
  20. www.buckinx.be
  21. www.lvwgroep.be
  22. www.vanopstalnv.be
  23. www.bosteelsmarc.be
  24. www.assurex.be
  25. www.baelde-willems.be
  26. www.timaver.be
  27. www.abmonline.be
  28. www.vandaele-co.be
  29. www.kantoorvantomme.be
  30. www.brijsverzekeringen.be
  31. www.flamey.be
  32. www.awdd.be
  33. www.confidis.be
  34. www.maurobvba.be
  35. www.assurfinancekantoor.be
  36. www.beterverzekeren.be
  37. www.zakenkantoor-luyssen.be
  38. www.kantoorremmerie.be
  39. www.rallyver.be
  40. www.turnhoutsassurantiekantoor.be
  41. www.eurobeheer.be
  42. insurance.vanguardlogistics.com
  43. www.kantoorhuyghebaert.be
  44. www.gouwy-soenen.be
  45. www.madesco.be
  46. www.kantoorgallet.be
  47. www.randon.be
  48. www.lzkverzekeringen.be
  49. www.christoffels-nv.be
  50. www.verzekeringenlaevers.be
  51. www.kantoorverduyn.be
  52. www.holkos.be
  53. www.peirens.be
  54. www.sibova.be
  55. www.assurea.be
  56. www.vuylstekebvba.be
  57. www.kantoorvanraemdonck.be
  58. www.vandyck-verzek.be
  59. www.opic.be
  60. www.walschots.be
  61. www.group-assurlim.be
  62. www.antares-verzekeringen.be
  63. www.zakenkantoor-louwet.be
  64. www.verbi-bvba.be
  65. www.vandenbussche-huyghebaert.be
  66. www.finplan4you.be
  67. www.hansvereecken.com
  68. www.paulvanvlierberghe.be
  69. www.verzekeringencoenen.be
  70. www.verassin.be
  71. www.roveba.be
  72. www.zk-nys.be
  73. www.zakenkantoorcools.be
  74. www.andes.be
  75. www.cooremanenpartners.be
  76. www.Dellafaille.be
  77. www.vanhouttebvba.be
  78. www.credicom.be
  79. www.deVerzekeringsMakelaar.be
  80. www.zakenburo.be
  81. www.s-team.be
  82. www.zonassur.be
  83. www.smismans.be
  84. www.de-jonghe.be
  85. www.proassur.be
  86. www.rappe.be
  87. www.deriek.be
  88. www.kegelsvanantwerpen.be
  89. www.jacobs.insure.be
  90. www.heremans.insure.be
  91. www.kantoor-degryse.be
  92. www.vanoerle.be
  93. www.omniservice.be
  94. www.zktr-dewindt.be
  95. www.bvbadepauw.be
  96. www.verassur.be
  97. www.zakenkantoorthys.be
  98. www.haelewyck.be
  99. www.verschaeve.insure.be
  100. www.lesseliers-co.be
  101. www.tomvanboxel.be
  102. www.vervoort-willekens.be
  103. www.kantoordeknijf.be
  104. www.axadiest.be
  105. www.service21.be
  106. www.julienplessers.be
  107. www.unihypinsurance.be
  108. www.hertoghe.net
  109. www.vandijckbvba.be
  110. www.adviesgroephasselt.be
  111. www.thys.com
  112. www.saelen-castelein.be
  113. www.ktv.be
  114. www.sarahswijsen.com
  115. www.kantoor-gysels.be
  116. www.bogaertnv.be
  117. www.multiservicecvba.be
  118. www.limassur.insure.be
  119. www.groepcauweverzekeringen.be
  120. www.vsfbvba.be
  121. www.filipbehaegel.be
  122. www.zakenkantoorberben.be
  123. www.finadvies.be
  124. www.groepsteegen.be
  125. www.deverzekeringsmakelaar.be
  126. www.hamaver.be
  127. www.swaegersverzekeringen.be
  128. www.laval.be
  129. www.bellefin.be
  130. www.kantoor-rammant.be
  131. www.axium-advies.be
  132. www.centeaduffel.be
  133. www.assuritis.be
  134. www.copper.be
  135. www.kredietmaatschappij.be
  136. www.kantoorvanhees.be
  137. www.dvrbvba.be
  138. www.dhauwers.com
  139. www.coverbel.be
  140. www.vandekeere.be
  141. www.goedkopeautoverzekering.be
  142. www.westservice.be
  143. www.groupevanhelmont.be
  144. www.kantoordefreyne.be
  145. www.rafdeclercq.be
  146. www.goetryenkindt.be
  147. www.desiere.be
  148. www.johnnylouwette.eu
  149. www.bestelening.be
  150. www.triumfinance.be
  151. www.mhadvies.be
  152. www.hovemak.be
  153. www.depotter.be
  154. www.vandekeere.com
  155. www.kantoordhont.be
  156. www.coverco.be
  157. www.hostenbvba.be
  158. www.kantoorhoet.be
  159. www.kve.be
  160. www.patrickchoquet.be
  161. www.dexters-verzekeringen.be
  162. www.vvfinance.be
  163. www.kantoor-vermeire.be
  164. www.verzekeringenverschuere.be
  165. www.coudron.be
  166. www.leleu-vdb.be
  167. www.ludosevers.be
  168. www.finassur.be
  169. www.insurantis.be
  170. www.de-nil.be
  171. www.adico.be
  172. www.rudyvoet.be
  173. www.rivdata.be
  174. www.offias.com
  175. www.gfh.be
  176. www.kantoordewaele.be
  177. www.naegels.be
  178. www.assuraz.be
  179. www.kantoorbortels.be
  180. www.q-fin.be
  181. www.ics-verzekeringen.be
  182. www.buyck-bvba.be
  183. www.verassfin.be
  184. www.assuria.be
  185. www.meus-nouwen.be
  186. www.dumontbvba.be
  187. www.beckx-vanuffelen.be
  188. www.ejw.be
  189. www.kantoorvanpraet.be
  190. www.gvl-verzekeringen.be
  191. www.dego-bvba.be
  192. www.vandenstockt.be
  193. www.marcblancquaert.be
  194. www.driesmans.com
  195. www.groepvandevijver.be
  196. www.steenhoudt.be
  197. www.insurea.be
  198. www.kantoorwindey.be
  199. www.goelen-lst.be
  200. www.tverzekeringskantoor.com
  201. www.zakenkantoorvandebergh.be
  202. www.dannyvervoort.be
  203. www.laureysvaes.be
  204. www.geeurickx.be
  205. www.melis-debo.be
  206. www.zakenkantoorgeers.be
  207. www.eurocasco.be
  208. www.kantoor-nagels.be
  209. www.dehainaut.be
  210. www.bogaert-daneels.be
  211. www.deridderkris.be
  212. www.deborle.be
  213. www.gysemansnv.be
  214. www.maesvz.be
  215. www.colpaert-verzekeringen.be
  216. www.vtieghem.be
  217. www.madou-verzekeringen.info
  218. www.zakenkantoorvanhoutte.be.insure3.be
  219. www.kantoorvanhoutte.be
  220. www.groepdenkens.be
  221. www.pvandekerkhof.be
  222. www.agathass.be
  223. www.ambverzekeringen.be
  224. www.kantoor-cms.be
  225. www.adfinas.be
  226. www.drconsulting.be
  227. www.finplanning.be
  228. www.adva.be
  229. www.wonemar.be
  230. www.assurdel.be
  231. www.finover.be
  232. www.bvbadelforge.be
  233. www.callaertverzekeringen.be
  234. www.oudenaards-zakenkantoor.be
  235. www.vacmakelaars.be
  236. www.dvls.be
  237. www.kantoorcassimons.be
  238. www.de-rocker.be
  239. www.vanmeirhaeghe.be
  240. www.verzekeringnodig.be
  241. www.delcroixverzekeringen.be
  242. www.verzekeringskantoortwc.be
  243. www.vancauwenberghe.be
  244. www.carlvanhoutte.be
  245. www.beets.be
  246. www.berrens.be
  247. www.francois-steenbeke.be
  248. www.credicom.be
  249. www.holderbeke-borloo
  250. www.degroote-avelgem.be
  251. www.claesenknoops.be
  252. www.davidpoot.be
  253. www.kantoorhbl.be
  254. www.assurmo.be
  255. www.rafdaenen.be
  256. www.anko-invest.be
  257. www.harolddevisscher.be
  258. www.looisverzekeringskantoor.be
  259. www.assurlan.be
  260. www.assurancesbrotcorne.be.insure3.be
  261. www.derveauxrubens.be
  262. www.drb-finance.be
  263. www.barriefinance.be
  264. www.affirmo-insurance.be.insure3.be
  265. www.smoldersverzekeringen.be
  266. www.vanbavelrommens.be
  267. www.domnv.be
  268. www.vbma.be
  269. www.Kantoor-Duprez.be
  270. www.fidelisteam.be
  271. www.s-team.be
  272. www.s-team.be
  273. www.s-team.be
  274. www.s-team.be
  275. www.ad-finance.com
  276. www.s-team.be
  277. www.s-team.be
  278. www.s-team.be
  279. www.proplan.be
  280. www.dvl.be
  281. www.johandesmet.be
  282. www.avkverzekeringen.be
  283. www.s-team.be
  284. www.s-team.be
  285. www.gebruers-ghoos.be
  286. www.verzekeringendgm.be
  287. www.krebaver.be
  288. www.kantoortheeus.be
  289. www.asekura.be
  290. www.nv-govaert.be
  291. www.assuconsultavlb.be
  292. www.kantoorjans.be
  293. www.vannijvel.be
  294. www.insuras.be
  295. www.dbdv.be
  296. www.verhybel.be
  297. www.spaarconsult.be
  298. www.verzekeringen-missinne.be
  299. www.dekoma.be
  300. www.ccverzekeringen.be
  301. www.zakenkantoorvanlinthout.be
  302. www.vadassur.be
  303. www.clincke.be
  304. www.henkdemeyer.be
  305. www.lissens-vanderplas.be
  306. www.kantoorbogaerts.be
  307. www.eak.be
  308. www.zakenkantoorvandeneynden.be
  309. www.veiligsparen.be
  310. www.kantoordaenen.be
  311. www.degeest-nv.be
  312. www.holderbeke-borloo.be
  313. www.lommelszakenkantoor.be
  314. www.ziekenhuisverzekering.be
  315. www.directassur.be
  316. www.guydriesen.be
  317. www.bogaertsbvba.be
  318. modulink6fr.insure.be
  319. www.kantoorvandenbroecke.be
  320. www.deleenmeesters.be
  321. www.kantoordasseleer.be
  322. www.zakenkantoormb.be
  323. www.kmoverzekeringen.be
  324. www.webassur.be
  325. www.declercq-ryheul.be
  326. www.zakenkantoorhoutman.be
  327. www.cosure.be
  328. www.assurop.be
  329. www.wiewauters.be
  330. www.verzekeringenvandenbogaerde.be
  331. www.kantoorthielemans.be
  332. www.fidesca.be
  333. www.verzekeringenvandenbranden.be
  334. www.beyens.info
  335. www.kantoorvanbiervliet.be
  336. www.zakenkantoorhendrikx.be
  337. www.joostdemoen.be
  338. www.kantoorgeysvreysen.be
  339. www.vandes.be
  340. www.desombe.be
  341. www.carcover.be
  342. www.assurantia.be
  343. www.nicoandries.be
  344. www.deverzekeraar.be
  345. www.kantooras.be
  346. www.thierie-boyen.be
  347. www.kantoorvandenbroeck.be
  348. www.verzekeringen-fonteyn.be
  349. www.tsjoen-verzekeringen.be
  350. www.daeseleire.be
  351. WWW.ASSURSERVICES.BE
  352. www.vanbiervliet.biz
  353. www.kantoorvv.be
  354. www.centeahoeilaart.be
  355. www.financieeladviesbureau.be
  356. www.dileass.be
  357. www.devreese.be
  358. www.vanlierdemarc.be
  359. www.profina.be
  360. www.jsdheylen.be
  361. www.rossignolternat.be
  362. www.autoverzekering-online.be
  363. www.roveba.be
  364. www.maxikrediet.be.modulink.be
  365. www.kinderenvandewereld.be.brokersite.be
  366. www.online-verzekering.be
  367. www.madescorumbeke.be
  368. www.arvconsult.be
  369. www.demoor.net
  370. www.assurpoppe.be
  371. www.buroderoeck.be
  372. www.groepvanhees.be
  373. www.geng.be
  374. www.groeneverzekering.be
  375. www.vankeymeulenbvba.be
  376. www.dkv-verzekering.be
  377. demo.modulink.be
  378. www.decubber-daneels.be
  379. www.anthonis-verzekeringen.be
  380. www.courtierbancaire.eu.modulink.be
  381. test.modulink.be
  382. www.vandenwegheverzekeringen.be
  383. www.zakenkantoorvangoethem.be
  384. www.kantoorgeebelen.be.vs05014.virtualserver.priorweb.be
  385. www.willemsenpartners.be
  386. www.verzekeringentrybou.be
  387. www.senioren-verzekering.be
  388. www.rafpostelmans.be
  389. www.schotte-derudder.be
  390. www.huysmanbikeinsurance.com.vs07013.virtualserver.priorweb.be/
  391. www.focusverzekeringen.be
  392.  
  393. SAMPLE DATA  (belsec has deleted some)
  394. -----------
  395.  
  396. Client ID:900    
  397. Name:Verzekeringskantoor J. Decubber - Daneels 
  398. Email: stef     
  399. Password: 
  400. City: Maarkedal
  401. Zip Code: 9681 
  402. Address:     
  403. URL:www.decubber-daneels.be    
  404. Phone: 055   
  405. Fax: 055/
  406. Name: Stefaan Decubber 
  407. Cell phone: 0475
  408.  
  409. Client ID: 807
  410. Name: Swaegers Verzekeringen
  411. Email:     
  412. Password:      
  413. City: Turnhout 
  414. Zip Code: 2300 
  415. Address: Kempenlaan      
  416. URL: www.veiligsparen.be       
  417. Phone: 014    
  418. Fax: 014/      
  419. Name: Koen Van Hees    
  420. Bank number: 320-

 

Permalink | |  Print |  Facebook | | | | Pin it! |

300 SQL databases hacked from Belgian lenders - insurers or bluff from Rex Mundi

Rex mundi has a history of doing some really freigthening stuff and publishing parts of it and at the other side bluffing and not publishing anything so it is difficult to make a difference between what is true and what is bluff and what he has and what was published

he is also some-one who like to play mindgames (tries it with me sometimes) so you have to think twice about everything he says (and besides the leaks there are enough time that he didn't deliver to be fair)

I don't underestimate him and I don't believe by security by obscurity so I think it is possible that sql attacks can nowadays still deliver the kind of data he is talking about (some even don't use https connections) just because it is not a tradition or obligation to test external databases against all the different kinds of sql attacks (now not only the automated ones, but also the manual, complicated, human ones).

that is why I think it is possible. He plays mindgames. So aside the automated stupid sql attacks he will probably do the things also manually when more expertise is necessary.

the first thing published is webassur.be but they say that it is a testdatabase of agents and not from clients

http://pastebin.com/7sNhXpXP

in another pasting he says he has hacked more than 300 insurance databases (in the database of the agents are also websites with probably databases and these are 400 in number and even if the passwords are wrong maybe they are all built the same (wrong) way and some are hosted on the same virtual cohost server so get one and you get many.

as these insurance agents are probably not really securityminded ITprofessionals and have maybe not enough security on their laptops they maybe have clicked on infected emails with zerodays giving him easy access to the pc and the website(s).

so do not underestimate him and do not believe all his bluff but sometimes he gets it rights and as in Poker, you can take your chance when somebody is bluffing but you can also lose everything

for the moment this means I have work to do, set things in motion, alert some bells

and if you have an sql database, than you should run to your website developer and get him to answer the following questions

* do you have the last versions

* did you install the security stuff

* do we only have information we really need (not the nice to have which is everything)

* do we have encrypted anything or is it dummy stuff

* do we have backups of everything

* do we have a take-down procedure

* what do we do if client information is published

* did you let it test by securitytesters and why not

depending on the answers, you will be happy to have really qualified people in charge or be in panick

Permalink | |  Print |  Facebook | | | | Pin it! |

09/14/2012

international fed of pharmacists hacked and data released

International Pharmaceutical Federation (FIP) The global federation of national associations representing 3 million pharmacists and pharmaceutical scientists around the world.  Fip.nl

the file with all the names and passwords and emails is here

http://www.anonpaste.me/anonpaste/index.php?81e35f465cb86a95#Bs/8df3ca1t20yqTm6MEp7MrH+AdUw8ifEI7+fhGHxY=

a few thousand and about 1.5 MB

Permalink | |  Print |  Facebook | | | | Pin it! |

09/11/2012

the necessary silence of 11 september in Chile and NY

democracy and socialist experiment killed by CIA supported military (1973)

more than 30 years later Chile is still recovering

Chileans ask : where were you that day and what did you do afterwards ?

democracy and open society attacked by islamic fundamentalists (2001)

the US and democracy is still recovering

Americans and the world watching ask : where were you that day ?

it are defining moments in the history of a people, a nation, its democracy, its concepts of security and freedom

Securitypeople learned that every detail can be important and has to be followed up but since than privacypeople have learnt that securitypeople want to follow all of us in a too detailed manner

Permalink | |  Print |  Facebook | | | | Pin it! |

Apple UID, it is in fact an mobile application firm that lost it (and didn't know)

So we know already about malware and spyware mobile apps sitting in the libraries (and even more on the web)

we have learned about the privacy concerns of all that data going to mobile developers

but as they were American we supposed they were guaranteeing the security and privacy of it all

it now is becoming clear that it is not a FBI agent responsable for recruiting new informers and agents on Facebook and boasting about it but the firm that was hacked and lost its clients connection data (and more according to Anonymous, probably all client data (but they forget to mention this in this article as source)

and after the release and even after the declaration of the source by Anonymous (like a Len Deighton novel, you never know who is doing what why for who) app developers were scrambling to find out if it was their data

not this firm, they had to be contacted by an independent security researcher (nice work) to go themselves to their database and compare the two to see that for more than 90% it was the same data and they contacted the FBI and don't release more information because of the 'ongoing investigation'

so what is clear from all this

* the information was not professionally encrypted or scrambled

* the information was not enough protected with data leakage prevention

* there was probably more information than strictly needed

* some parts of the information were not seperated according to use (billing, usage and login, profile)

time to modernize that wild mobile west

http://redtape.nbcnews.com/_news/2012/09/10/13781440-excl...

https://www.google.be/search?q=Blue+Toad+publishing+company

oh and remember there are 12 million UID's stolen and all other member data also financial is also in the possession of them, they only released one million and only the UID's (they claim)

Permalink | |  Print |  Facebook | | | | Pin it! |

DNS is really professional business GO Daddy (and others) not some add on

"The more problematic part is that any domain registered with GoDaddy that uses its nameservers and DNS records are also down," Mashable wrote. "That means that even if you host your site elsewhere, using GoDaddy for DNS means it is inaccessible."

 

The company, which says it hosts 53 million domain names, has acknowledged the outage on its Twitter feed but has not commented on the cause of the problem.
http://edition.cnn.com/2012/09/10/tech/web/go-daddy-outag...

so some facts

* this isn't a ddos (or it is against the DNS infrastructure specifically)

* and it isn't by the whole Anonymous operations, just some person of it claiming its name or abusing it, but that is also what Anonymous is

what does it mean

* dns is very serious business in which you should invest and for which you should or use professional services (who invest a lot of it because it is their core business) or invest personnel, monitoring and protecting in it

otherwse you are just a King without clothes, ready to be shown naked every time some dude around the web thinks it is time to do so

Permalink | |  Print |  Facebook | | | | Pin it! |

how to search All emails to the Syrian Ministry of Foreign Affairs with Google

WikiLeaks has released all emails (32,476) to and from the Syrian Ministry of Foreign Affairs as part of the Syria Files.
http://www.thisdayinwikileaks.org/2012/09/091012.html

this is only part of the enormous collection (give us the database with all to search)

it is not searchable (if you find something Belgian, let me know :))

You will find them here

http://wikileaks.org/syria-files/releasedate/2012-09-10-1...

and now how to use Google to search them

well use this Googledork

site:http://wikileaks.org/syria-files/releasedate/2012-09-10-13-ministry-of-foreign-affairs-and-expatriates (and put behind it whatever term, name, emailadres, ..... you would like) and open the results in a different tab so you can go back

mails are in .obj format sometimes  http://www.fileinfo.com/extension/obj

there is also a lot of spam in it which means their mailboxes weren't properly secured and they use Kaspersky for those who want to know :)

nice hunting

 

Permalink | |  Print |  Facebook | | | | Pin it! |

stratfor (private CIA) thinks Israel is spying on industrial and economic complex in the US

Email-ID 1109886
Date 2011-01-18 14:35:07
From burton@stratfor.com
To analysts@stratfor.com
List-Name analysts@stratfor.com

 

We can't loose site of the Mossad penetration and theft via industrial
espionage, meaning the U.S. fell victim due to shoddy oversight, govt
contracts, etc.

The high-tech areas in CONUS (to include Austin) are crawling w/Israeli
operatives, false flag companies and agents of interest.

http://www.wikileaks.org/gifiles/docs/1109886_re-os-us-ir...

that is what friends are for .....

Permalink | |  Print |  Facebook | | | | Pin it! |

1 2 3 Next