| Read the Digest in
PDF.
You need the free
Adobe
Reader.
| |||
|
The digest of current topics on Continuous Availability. More than Business Continuity Planning. BCP tells you how to recover from the effects of downtime. CA tells you how to avoid the effects of downtime.
| |||
|
In this issue:
Hacked AP Tweet Crashes Markets Oracle Releases Massive Java Patch
Browse through our Useful Links. See our article archive for complete articles. Sign up for your free subscription. Visit our Continuous Availability Forum. Check out our seminars. Check out our writing services. |
My wife made me do it. A news junkie, she is a huge Twitter fan; and I suspect she follows every media outlet on the planet. Now the Availability Digest will be tweeting as well. Check us out at @availabilitydig. Every month in the Digest, we focus on four articles of significance surrounding issues of high availability and continuous availability. However, there are many more stories to be told – new solutions, harrowing tales of downtime woe, expert input about availability issues, mea culpas from victims of outages, failover considerations, backup services, disaster-recovery alternatives - not a day goes by when some newsworthy event or some clever approach to availability is made public for discussion and review. With our new presence on Twitter, we plan to update you regularly with links not only to the topics we cover in the Digest but also to similar subject matter. We also ask your help in alerting us to topics that you feel may be of interest to our Digest subscribers and to our Twitter followers. Just send me a note at editor@availabilitydigest.com. Thanks.
Dr. Bill Highleyman, Managing Editor | ||
|
Never AgainHacked AP Tweet Crashes Markets
On April 23, 2013, an Associated Press tweet reported that President Obama had been injured in an explosion at the White House. It sent the U.S. financial markets into an instant tailspin when high-frequency trading systems automatically read and processed the tweet. Fortunately, the tweet was false. The AP Twitter account had been hacked. However, what does this mean for “flash crashes” in the future when unverified and perhaps malicious information is disseminated via social media?
Tweets like this could be used by a malicious party to short stocks just before the tweet is released so that the short could be covered at the dip. Alternatively, the malicious party could buy stocks at the dip just before the hacked tweet is exposed.
If you combine the flood of instant information – often unverified – on social media with automated trading programs that buy and sell in microseconds based on that information, you get the potential for a big mess such as the flash crash caused by the AP tweet. We can expect further such crashes in the future. It’s not the fact that social media is subject to hacking. It is that we have high-frequency trading algorithms that react to social media whether it is right or wrong. --more-- The $45 Million ATM Heist
Perhaps the biggest financial cybercrime in history was carried out early this year when “cashiers” around the world branched out with phony, limitless prepaid debit cards and withdrew USD $40 million from ATMs in 27 countries in ten hours. Much of this money has not been found, and the brains behind the operation are yet to be identified.
The attacks actually occurred at two different times. On December 22, 2012, thieves stole USD $5 million dollars from ATMs worldwide. Then on February 19, 2013, the thieves struck again and stole another USD $40 million. It seems that the first attack may have been a dress rehearsal for the second, much larger attack.
Both attacks used cloned prepaid debit cards whose withdrawal limits had been eliminated or set extremely high by hackers.
Unfortunately, these attacks are not unusual. Tens of millions of dollars have been stolen from European banks in the past year through ATM fraud. In one instance, hackers took USD $9 million from one European bank’s ATMs in 46 cities. As with so many other types of cyberattacks, these attacks can only be mitigated with powerful security tools that can detect intrusions and other security violations as they are happening so that they can be stopped. --more-- Spamhaus Attacker Caught
A massive Distributed Denial of Service (DDoS) cyberattack was waged against the Dutch spam-filtering company, Spamhaus, during March of this year. It is believed to be the largest DDoS attack in the history of the Internet. The alleged mastermind of the attack, Sven Olaf Kamphuis, 35, has now been arrested in Spain and has been extradited to The Netherlands. There he will stand trial under Dutch law for the criminal offense of launching a DDoS attack.
CyberBunker is a Dutch web site that claims it will host anything but child pornography and terrorism-related content. The CyberBunker web site was designated a spam site by Spamhaus and is on the Spamhaus blacklist. In retaliation, CyberBunker, headed by Kamphuis, launched a massive DDoS attack against Spamhaus in an attempt to shut it down. DDoS attacks are on the rise. They are easy to accomplish and can do significant damage to a company’s public-facing web sites. Companies must be prepared to undertake emergency procedures to mitigate such attacks. One possible approach is to use a DDoS mitigation company. These companies can redirect malicious DDoS traffic to their scrubbing centers and can forward only legitimate traffic to the victim company.
Oracle Releases Massive Security Patch for Java
Following last January’s recommendation by the U.S. Department of Homeland Security (DHS) to disable Java in browsers, Oracle now has come out with a massive set of patches to try to plug security holes in Java.
Oracle has released its April 2013 Critical Patch Update for Java SE. The quarterly release comes a few months after Facebook, Twitter, and NBC News suffered attacks due to Java vulnerabilities that allowed hackers to infiltrate their networks.
The April 2013 CPU for Java SE addresses forty-two security flaws. Thirty-nine vulnerabilities were remotely exploitable without authentication (username and password). These vulnerabilities would have allowed a remote, unauthenticated attacker to execute arbitrary code, to cause a denial of service, or to gain unauthorized access to a company’s files or systems. The Java ecosystem pioneered many new features that made developing software for multiple platforms easier. The Java Runtime Environment was the result of that need for easier cross-platform development. Sadly, the reputation of the Java ecosystem has taken a significant hit due to the large number of security vulnerabilities exposed in the JRE and in Oracle's software-development lifecycle.
Sign up for your free subscription at https://availabilitydigest.com/signups.htm
Would You Like to Sign Up for the Free Digest by Fax?
Simply print out the following form, fill it in, and fax it to: Availability Digest +1 908 459 5543
| |||
|
The Availability Digest is published monthly. It may be distributed freely. Please pass it on to an associate. Managing Editor - Dr. Bill Highleyman editor@availabilitydigest.com. © 2013 Sombers Associates, Inc., and W. H. Highleyman | |||
