Ethical Hacker Backer Hacked, Warns of Email Ransack

The IT security certification body that runs the Certified Ethical Hacker programme has itself been hacked.

The EC-Council said the same hackers who ran the DNS poisoning attack that resulted in the defacement of its website in late February had also managed to access the control panel for its website after breaking into the systems of a third-party registrar. This compromised access allowed the miscreants to circumvent security controls and get into the security organisation’s email system, as a breach notice from the EC-Council to its members explains.

EC-Council uses a cloud service provider for enterprise email. Once the domain privilege was attained, the hacker then issued a password reset request to the email service provider. This circumvented EC-Council’s best practices of using complex passwords and 2-factor authentication. We have informed the service provider of this password reset policy vulnerability and are hopeful that they have already rectified it for the benefit of the IT community in general.

With administrative access to the email service provider, the hacker was able to compromise a small number of email accounts before the EC-Council security team was able to respond to the breach.This resulted in unauthorized access to messages in those specific email boxes for a short duration of time.

The investigation into the breach is still ongoing and it’s unclear which member data, if any, has been exposed. Credit card transactions are run through a different system that wasn’t exposed by the attack but any private information sent by email might have been compromised, although this is uncertain.

via Ethical hacker backer hacked, warns of email ransack • The Register.

———————————————-

Journal of Law & Cyber Warfare | www.jlcw.org The Journal of Law & Cyber Warfare provides a public peer-reviewed law publication to foster open discussion and education of technology, government and legal stakeholder in relation to the complex issue of cyber warfare.  Journal of Law & Cyber Warfare accepts articles written by military, technology, judges, government officials, academic and legal practitioners.  The Journal of Law & Cyber Warfare provides a public peer-reviewed law publication to foster open discussion and education of technology, government and legal stakeholder in relation to the complex issue of cyber warfare.  Journal of Law & Cyber Warfare accepts articles written by military, technology, judges, government officials, academic and legal practitioners. The Journal of Law & Cyber Warfare is honored by the world class caliber editorial board that is involved with the Journal. Thought leaders from forensics, law, warfare, and cyber security are on the Board. The Journal is always looking for interested thought leaders who believe they can contribute in a meaningful fashion to the development of cyber warfare scholarship.