Vajad kellegagi rääkida?
Küsi julgelt abi LasteAbi
Logi sisse

Sotsiaalne tarkvara ja võrgukogukonnad wiki (0)

1 Hindamata
Punktid
Problem 1
In April 2011,  Sony   experienced  a data  breach   within  their  PlayStation   Network . It is  estimated  that the
information of 77 million  users  was compromised.
Sources
" based  on information currently  available  to Sony, our currently  known   costs  associated with the unauthorized
network  access  are estimated to be approximately 14  billion  yen," or about $171 million.
http://www.informationweek.com/security/attacks/sony-data-breach-cleanup-to-cost-171-mil/229625379
The attacker said he exploited the  Greek  Sony  website  using a SQL injection attack against the site, which was
running   Internet  Information  Server  (IIS) 6.0 on  Windows  2003. SQL injection  attacks , which exploit website
databases that haven't been patched against known vulnerabilities, are much favored by attackers, in  part  for
their simplicity.
http://www.informationweek.com/security/attacks/sony-data-breach-cleanup-to-cost-171-mil/229625379
The  details  of the users of the  worldwide  PlayStation Network – used by owners of Sony Playstation 3s and
PlayStation Portables –  include   names , addresses,  dates  of  birthemail  addresses, and passwords to the network.
http://www.guardian.co.uk/technology/2011/apr/27/playstation-users-identity-theft-data-leak
Sony has not said how the hackers broke in. But Rik Ferguson, a computer  security  consultant at Trend Micro,
said: "This has all the hallmarks of commercial  criminal  activity  going  for a saleable commodity. It doesn't look
as though they would have  broken  in directly  through  the PlayStation Network. Far more likely is that they
breached the  corporate  systems and then moved through  them  to access this  valuable  data."
http://www.guardian.co.uk/technology/2011/apr/27/playstation-users-identity-theft-data-leak
Sony has been criticised for the  fact  that the hackers have apparently been  able  to  copy  the data directly,
implying it was not encrypted.
http://www.guardian.co.uk/technology/2011/apr/27/playstation-users-identity-theft-data-leak
Sony shut the PlayStation Network down immediately but  unfortunately  did not notify its clients for  seven   days .
http://www.nyc.gov/html/doitt/downloads/pdf/newsletter_security_201105.pdf
That would make it the seventh data breach suffered by Sony  since  April 2011.
http://www.informationweek.com/security/attacks/sony-data-breach-cleanup-to-cost-171-mil/229625379
Sony Computer Entertainment  Europe  has been fined £250,000 ($396,100)  following  a "serious breach" of the
Data Protection Act.
http://www.bbc.co.uk/news/technology-21160818
Result
Aasta  2011   aprillis   tabas   firmat   Sony   seitse   erinevat  andmeid  puudutavat  rünnakut1,  mille   eeldatav  kahju on
vähemalt  109.4  miljonit  eurot.   Oluliseim   rünnak  toimus  PlayStation  Network  vastu,  mille  käigus  suudeti
kopeerida  krüpteerimata  kasutajate  andmed  nagu  :  nimed,  aadressid,  sünnikuupäevad,  email  aadressid  ja
süsteemi  paroolid2.  Olukorra  tegi  hullemaks  ka  asjaolu,  et  Sony  ei  teavitanud  oma  kliente  rünnakust  seitsme
ööpäeva  jooksul3.  Firma  Euroopa  osakonda  trahviti seetõttu  andmekaitse   seaduse  alusel 297200  euroga, kuna
leiti et probleem oleks olnud välditav4.
PlayStation  Network’i  intsidendi  puhul  pole  Sony  avalikult  avaldanud,  kuidas  andmetele  juurdepääs  toimus.
Turva  eksperdi   Rik Ferguson’i hinnangul ei suudetud sisse  murda  otse läbi PlayStation Network’i vaid eelnevalt
oli  suudetud  sisse  murda  ettevõtte  süsteemidesse,  mida  kasutati et soovitud andmetele ligi pääseda5.  Näiteks
kasutati  Kreeka  Sony  veebilehe  sissemurdmisel  SQL  süst  rünnakut,  mis  kasutas  Windows  Server  2003
operatsiooni süsteemi IIS 6.0, m
  is omakorda on t
  untud e
  kspertide s
  eas o
  ma turvaaukude s
  issemurdmise lihtsuse
tõttu6.
1
http://www.informationweek.com/security/attacks/sony­data­breach­cleanup­to­cost­171­mil/229
625379
http://www.guardian.co.uk/technology/2011/apr/27/playstation­users­identity­theft­data­leak
http://www.nyc.gov/html/doitt/downloads/pdf/newsletter_security_201105.pdf
http://www.bbc.co.uk/news/technology-21160818
http://www.guardian.co.uk/technology/2011/apr/27/playstation-users-identity-theft-data-leak
6
http://www.informationweek.com/security/attacks/sony-data-breach-cleanup-to-cost-171-mil/2296
25379
Problem 2
In June 2011, Citigroup disclosed a data breach within their  credit  card operation, affecting approximately 210,000
or 1% of their customers'  accounts .
Sources
Last week, the company said a  total  of 360,083  North  American Citigroup credit card accounts were affected by
the  cyber  attack in May, the latest in a spate of attacks in recent months targeting high-profile  companies  like
Sony, Google Inc and Lockheed Martin.
http://www.reuters.com/article/2011/06/28/us-citigroup-idUSTRE75R7G220110628
(Reuters) - Citigroup, the third-largest U.S.  bank  by assets, has  told   government  officials that about 3,400 of the
customers whose credit-card information was  hacked  have suffered about $2.7 million in losses, the  Wall  Street
Journal  reported.
http://www.reuters.com/article/2011/06/28/us-citigroup-idUSTRE75R7G220110628
The exposed  account  information included names, account  numbers , email addresses, and contact details
http://www.informationweek.com/security/attacks/citigroup-confirms-hackers-stole-custome/230500141
Citi apparently  discovered  the Citi Account Online breach in May,  during  routine systems maintenance.
http://www.informationweek.com/security/attacks/citigroup-confirms-hackers-stole-custome/230500141
Basically after you logged into your account as a Citi customer, the URL contained a code identifying your
account. All you had to do was  change  around the numbers and  boom , you were in  someone   else ’s account.
So if the URL was  something  like citibank.com/ user /12345, all you had to do was change it to
citibank.com/user/123456 and you had access to all of their account information.
The hackers then used a  simple   script  that automatically scraped all the account information, saved it, and then
changed the numbers in the URL and repeated the  process . Hundreds of thousands of  times .
http://consumerist.com/2011/06/14/how-hackers-stole-200000-citi-accounts-by-exploiting-basic-browser-vulne
rability/
In the Citi attack, the hackers did not obtain expiration dates or the three-digit security code on the  back  of the
card, which will make it harder for thieves to use the information to commit fraud.
http://www.nytimes.com/2011/06/14/technology/14security.html?src=recg&pagewanted=all&_r=0
Result
Aasta 2011 mai kuus tabas Citigroup panka rünnak, mis mille käigus ligikaudu 1% kasutajate krediitkaardi  konto
andmetele pääseti ligi. Rünnak hõlmas 360083 Põhja Ameerika osakonna krediitkaardi kontot7 . Kätte saadud
andmed sisaldasid kasutaja nime, konto numbrit, email aadressi ja kontaktandmeid8. Rünnaku käigus ei
suudetud ligi pääseda kaardi lõputähtajale ega kolmetähelisele turvakoodile kaadi  tagaosas , mistõttu on antud
informatsiooni kasutamine kuriteo toimepanekuks raskendatud9. Rünnak tuvastati rutiinse hoolduse käigus.
Citigroup panka rünnaku puhul siseneti veebisüsteemi olemasoleva kasutajaga ja ning muudeti veebilehe
parameetreid, mis olid salvestatud URL’is. Kuna server ei kontrollinud pärast esmasisenemist kasutaja ja konto
ühtivust oli võimalik näha teiste kasutajate andmeid. Rünnaku jaoks kirjutati bot, mis automaatselt salvestas
teiste kontode andmeid, kogudes neid tuhandete kaupa10.
http://www.reuters.com/article/2011/06/28/us-citigroup-idUSTRE75R7G220110628
http://www.informationweek.com/security/attacks/citigroup-confirms-hackers-stole-custome/230500141
http://www.nytimes.com/2011/06/14/technology/14security.html?src=recg&pagewanted=all&_r=0
10
http://consumerist.com/2011/06/14/how-hackers-stole-200000-citi-accounts-by-exploiting-basic-browser-vulne
rability/
Problem 3
In March 2011, RSA suffered a breach of their SecurID  token  system  seed -key  warehouse , where the seed keys for
their 2- Factor  authentication system were stolen, allowing the attackers to replicate the hardware tokens used
for secure access in corporate and  government  environments.
Sources
The company, which pioneered an advanced cryptographic system during the 1980s, sells  products  that  offer
stronger computer security  than  simple password protection. Known as multifactor authentication, the
technology  is typically based on an electronic token carried by a user that repeatedly generates a time-based
number that must be appended to a password when a user logs in to a computer system.
http://www.nytimes.com/2011/03/18/technology/18secure.html?_r=0
Mr. Coviello said that the company’s investigation had revealed that the intruder successfully  stole  digital
information from the company that was  related  to RSA’s SecurID two-factor authentication products. He did not
give precise details about the  nature  of the information, but said it  could  potentially  reduce  the effectiveness of
the system in the  face  of a “broader attack.” The company said that  there  was currently no indication that the
information had been used to attack its customers.
http://www.nytimes.com/2011/03/18/technology/18secure.html?_r=0
Result
RSA 2011
Aasta 2011 märtsikuus tabas firmat RSA rünnak, mille käigus nende andmeturvavaramu süsteemi seed-key’id,
mida kasutati kahe osapoolevaheliseks audentimiseks aeg-sünkroniseeritud key fob’ idega , suudeti varastada.
RSA on tuntud kui üks peamisi krüptograafiliste süsteemide edasiarendajana, ning paljusid tabas see üllatusena.
RSA mainis avaliku tagasiside käigus, et taoline informatsioon võib osutuda kasulikuks vaid laialdase rünnaku
puhul. http://www.nytimes.com/2011/03/18/technology/18secure.html?_r=0
RSA’s saadud andmeid kasutati massivses rünnakus Lockheed Martin’i, ameerika suurima sõjaväe varustuse
looja, vastu. RSA’s saadud võtmeid kasutati selleks, et üle VPN’i kaughalduse sisse murda.
http://www.informationweek.com/government/security/lockheed-martin-suffers-massive-cyberatt/229700151
Vasakule Paremale
Sotsiaalne tarkvara ja võrgukogukonnad wiki #1 Sotsiaalne tarkvara ja võrgukogukonnad wiki #2 Sotsiaalne tarkvara ja võrgukogukonnad wiki #3 Sotsiaalne tarkvara ja võrgukogukonnad wiki #4 Sotsiaalne tarkvara ja võrgukogukonnad wiki #5 Sotsiaalne tarkvara ja võrgukogukonnad wiki #6 Sotsiaalne tarkvara ja võrgukogukonnad wiki #7
Punktid 5 punkti Autor soovib selle materjali allalaadimise eest saada 5 punkti.
Leheküljed ~ 7 lehte Lehekülgede arv dokumendis
Aeg2013-05-22 Kuupäev, millal dokument üles laeti
Allalaadimisi 9 laadimist Kokku alla laetud
Kommentaarid 0 arvamust Teiste kasutajate poolt lisatud kommentaarid
Autor margusmartsepp Õppematerjali autor
Grupiprojekti üks osa. Leitud on probleemid, neid on uuritud ja siis tehtud nendest Eesti keeles kokkuvõtted.Grupitöö kokkuvõttes sai 27/30p.

Kasutatud allikad

Sarnased õppematerjalid

Big data in cloud
9
docx

Big data in cloud

A B S T R A C T W e l c o m e t o t h e n e w e r a o f b i g d a t a . P ii s Big a v data a l in t C o clou o l d I T opportu I 0 Academic essay (ITI0103) 2019 spring Introduction “Data is Everything and Everyone is Data. “[1] The ability to collect, organize, structure and analyse data on a large scale is probably the most significant trait that sets us, humans, apart from our primate friends. [1] To comprehend the opportunities and threats regarding big data loc

Algoritmid ja andmestruktuurid
Misusing and Abusing the IoT- Ingliskeelne referaat andmeturve ITX0040 jaoks
14
docx

Misusing and Abusing the IoT ( Ingliskeelne referaat andmeturve ITX0040 jaoks)

Misusing and Abusing the IoT - Now and in the Future The Internet of Things is the network of physical objects—devices, vehicles, buildings and other items which are embedded with electronics, software, sensors, and network connectivity, which enables these objects to collect and exchange data [1]. As the amount of devices connected to the internet of things is constantly on the rise, making it innately more secure and protecting those devices from abuse, in a sense of unwanted access , manipulation by third parties and other scenarios, is rapidly turning into a pressing issue. According to some sources there were about 13.4 billion connected devices back in 2015 and the projections show there might be up to 38.5 billion such devices in 2020 [2]. As the number of devices increases, the necessity for a proper security mechanism concerning those devices becomes a priority in order to safely adopt the evergrowing internet of things into every aspect of a persons daily life. Privacy On

Andmeturbe alused
Thesis Kivimaa August 2022
140
pdf

Thesis Kivimaa August 2022

Thesis “How is it possible to calculate IT security effectiveness?” Kristjan Kivimaa August 2022 1 Abstract In IT Security world, there is lack of available, reliable systems for measuring security levels/posture. They lack the range of quantitative measurements and easy and fast deployment, and potentially affects companies of all sizes. Readily available security standards provide qualitative security levels, but not quantitative results – that would be easily comparable. This deficiency makes it hard for companies to evaluate their security posture accurately. Absence of security metrics makes it complicated for customers to select the appropriate measures for particular security level needed. The research question for this research project is – “How is it possible to calculate IT security effectiveness?”. The aim of this research is to use this reference m

Infotehnoloogia
Identiteedivargus
7
doc

Identiteedivargus

Identity theft The Estonian Information Technology College Social, Professional and Ethical Aspects of Information Technology 18.10.2016 The purpose of this paper is to raise awareness about the threats associated with Identity theft. I will talk about the different types of identity theft, the most common way they take place and what consequences they might have. I will also talk about some of the examples and point out actions everyone can take to minimize the chance of becoming a victim of an identity theft. What is Identity theft Identity theft is defined as the deliberate use of someone else's identity, usually as a method to gain a financial advantage or obtain credit and other benefits in the other person's name, and perhaps to the other person's disadvantage or loss. The person whose identity has been assumed may suffer adverse consequences if they are held responsible for the perpetrator's actions. Identity theft oc

Inglise keel
Social media information and data collection and security
16
docx

Social media information and data collection and security

New Media Economy Social media information and data collection and security In this brief essay, i would like to focus on the social media platforms in our moren society. How people use them, what kind of information we give away, what companies will do with this. Information sharing and data protection has become very popular theme in the recent few years. People care more about their privacy and avoid „big brother“ foreshadowing. It is important to know what social media platforms promise and are they really going to keep it. Users should think about what they share and what kind of information they generate. Because it is all recorded and some info can be traced back to real people. Privacy and data protecion topics are becoming more and more important and the amouts of data generated is becoming larger. When wrongly access this kind of data, a lot damage could be done by criminals. Users privacy settings should be reviewd and fixed when needed. Social media Humans hav

Inglise keel
Trojan horse
14
docx

Trojan horse

Eriala: Informaatika Inglise keel Referaat «Trojan horse » Lektor S.Remmelg Üliõpilane A.Parts Rühm RDIR23 Kood 103373 Introduction Trojan (also - troyamn, troyamnets, troyamnsky horse Troma) - a program used by an attacker to gather information, its destruction or modification of, computer malfunction or use of its resources in the wrong purposes. According to the principle of distribution and of the Trojans is not a virus because it does not spread by self-reproduction. This Trojan is run by the user manually or automatically - the program or part of the operating system running on a victim computer (as a module or utility). For this program file (the name, icon of the program) is called the official name of masquerading as another program (such as the installation of another program), another file type, or just give us attractive to run a name, icon, etc. Similar mali

inglise teaduskeel
Games Programming with Java and Java 3D
23
pdf

Games Programming with Java and Java 3D

Games Programming with Java and Java 3D Andrew Davison Dept. of Computer Engineering Prince of Songkla University HatYai, Songkhla 90112 E-mail: [email protected] Draft: 14th January 2003, #2 Abstract This article looks at the advantages and disadvantages of using Java and Java 3D for games programming. It assumes the reader is familiar with Java, but presents short overviews of gaming, the low-level APIs OpenGL and DirectX, and Java 3D. No programming examples are included here, although links to online code are supplied. 1. Background to Gaming Giving a definition for `computer game' is problematic, due to the wide range of game types. For example, the ArcadePod site (http://www.arcadePod.com) divides its hundreds of Java games into more than ten categories: 3D games, multiplayer, action

Java programmeerimine
BUSINESS VOCABULARY
10
docx

BUSINESS VOCABULARY

PRODUCTS and BRANDS 1. product catalogue - a list of different products of one company 2. product mix - a range of similar in some way products considered together 2. product range - different particular and specific products of a company 3. product lifecycle - the stages of product lifetime and amount of people who use it at each stage 4. product positioning - is how we see a product or how a company would like us to see it in relation to other products 5. product placement - hidden commercial of a product. Customer can see a product in films, music videos and so on. 6. raw materials - basic materials from which products are made or manufactured 7. finished goods - are goods(products) that have completed manufacturing process and are ready to be sold and used by the end user 8. consumer goods - goods which are produced to satisfy consumer current needs and are bought for individual use 9. consumer durables - long time lasting products, such as home appliances, cars and so on 10. fast

Inglise keel




Kommentaarid (0)

Kommentaarid sellele materjalile puuduvad. Ole esimene ja kommenteeri



Sellel veebilehel kasutatakse küpsiseid. Kasutamist jätkates nõustute küpsiste ja veebilehe üldtingimustega Nõustun