Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Database Security
Authentication
Mobile
Privacy
Compliance
Careers and People
Identity & Access Management
Security Monitoring
Advanced Threats
Insider Threats
Vulnerability Management
Comments
15-Year-Old Arrested For TalkTalk Attack
Threaded  |  Newest First  |  Oldest First
Joe Stanganelli
Joe Stanganelli,
 User Rank: Ninja
10/26/2015 | 11:16:58 PM
"Sequential"
More than anything else, this story really demonstrates the importance of experienced and prepared PR and having good crisis communications.  Here, the CEO just comes off looking like an idiot, which is unfortunate.

Unsurprisingly, the company's stock was down more than 12% yesterday.
RyanSepe
RyanSepe,
 User Rank: Ninja
10/27/2015 | 8:36:02 AM
Re: "Sequential"
Agreed. In cases like this, should the CEO be giving the press release? Or should it be someone with a greater exposure and a higher knowledge base to the current ongoings.
Dr.T
Dr.T,
 User Rank: Ninja
10/27/2015 | 11:58:03 AM
Re: "Sequential"
Agree, it should always be somebody who knows how to communicate to mass audience.
Joe Stanganelli
Joe Stanganelli,
 User Rank: Ninja
10/27/2015 | 8:25:58 PM
Re: "Sequential"
@Ryan: Indeed.  I could understand if this was a nimble startup, but not a major ISP or telco!
RajanP605
RajanP605,
 User Rank: Apprentice
10/27/2015 | 10:04:25 AM
Re: "Sequential"
Unfortunately there are many idiots out there with their big egos, total ignorance and just a good vocabulary / speaking skills that cover their ignorance.
Dr.T
Dr.T,
 User Rank: Ninja
10/27/2015 | 12:08:29 PM
Re: "Sequential"
I hear you, at the same time PR person is critical when there is a security bridge, otherwise things go worse than bridge itself.
Dr.T
Dr.T,
 User Rank: Ninja
10/27/2015 | 11:56:26 AM
Re: "Sequential"
CEOs are never good communicators. They always need PR persons.
Joe Stanganelli
Joe Stanganelli,
 User Rank: Ninja
10/27/2015 | 8:27:03 PM
Re: "Sequential"
I'm not sure about CEOs not being good communicators.  Steve Jobs comes to mind...
SgS125
SgS125,
 User Rank: Ninja
10/27/2015 | 9:15:15 AM
Encryption part of story is meaningless -why include it?
Whether the data was encrypted or not has nothing to do with the ability of an attacker to compromise credentials and steal whatever the stolen account has access to.  In this case probably a service account in a program with full read rights.  Why is the media so obsessed with reporting about encryption?  If someone gets compromised the encryption does NOTHING to protect you.  The media is just spreading ignorance to the public which does not care and can only remember that that encryption is some kind of protection.  A falsehood that is spread.
Dr.T
Dr.T,
 User Rank: Ninja
10/27/2015 | 12:01:32 PM
Re: Encryption part of story is meaningless -why include it?
I would think encryption is part of the solution, without it there are other opportunities to exploit vulnerabilities. SQL injection is just one of those.
nani1
nani1,
 User Rank: Apprentice
11/30/2015 | 1:52:14 AM
Re: Encryption part of story is meaningless -why include it?
he was too intalegent
Joe Stanganelli
Joe Stanganelli,
 User Rank: Ninja
10/27/2015 | 8:31:08 PM
Re: Encryption part of story is meaningless -why include it?
Encryption is meaningless in attacks like these, but not meaningless overall.  I think it has more to do with the fact that something that ought to have been done should have been done -- regardless of the impact on the present circumstances.  It's like a restaurant being caught up in identity theft of its credit card-paying customers, and then in ensuing investigations finding out that the employees never washed their hands.  The two have nothing to do with each other, but still.
Dr.T
Dr.T,
 User Rank: Ninja
10/27/2015 | 11:54:34 AM
Somebody arrested?
That is surprising that they locate and arrested somebody. We need more examples of these. What is surprising is that although we know what the solution is there is still SQL injection out there.
Rene Paap
Rene Paap,
 User Rank: Author
10/29/2015 | 7:09:39 PM
Double dipping due to DDoS
This attack strategy seems to be two-fold: One DDoS attack was launched to take down the website and more importantly, distract the security staff. This may have given the attacker an opportunity to extract customer data records that were not (all) encrypted. Now the attacker has an extortion opportunity and threatens the company to publicize these records. So encryption (or lack thereof) is certainly related to this cyber-crime, though unrelated to the DDoS, technically speaking.
tedster50
tedster50,
 User Rank: Apprentice
10/30/2015 | 11:53:41 AM
CEO should resign
Pre-breach, a security specialist, Paul Moore, wrote in a blog post that representatives from the TalkTalk CEO's office were "aggressive, defensive and dismissive" when he pointed out that the company's My Account website and webmail service did not use TLS/SSL encryption.  

paul.reviews / value-security-avoid-talktalk

Post breach, the CEO of TalkTalk admits that they did not encrypt any customer financial information but was "not legally required" to do so - because the UK's 1998 Data Protection Act does not explicitly require encryption.
RobT221
RobT221,
 User Rank: Apprentice
11/10/2015 | 10:06:12 AM
Re: CEO should resign
It's never too late to turn this over to your PRE-defined process to include Incident messaging (InfoSec/CIO) (FAQ questions/answers included). 

Teachable moments are not for your reaction but for your response.  After Action reviews/remediation steps....

 
VaysI512
VaysI512,
 User Rank: Apprentice
10/31/2015 | 6:18:26 AM
15 year old arrested for Talk Talk Attack
The boy is smart enough to hack the talk talk site, he lost his mind in backmailing the CEO of the company.
Ray James
Ray James,
 User Rank: Apprentice
11/2/2015 | 9:27:43 AM
Re: 15 year old arrested for Talk Talk Attack
So not surprising at all.


Edge-DRsplash-10-edge-articles
I Smell a RAT! New Cybersecurity Threats for the Crypto Industry
David Trepp, Partner, IT Assurance with accounting and advisory firm BPM LLP,  7/9/2021
News
Attacks on Kaseya Servers Led to Ransomware in Less Than 2 Hours
Robert Lemos, Contributing Writer,  7/7/2021
Commentary
It's in the Game (but It Shouldn't Be)
Tal Memran, Cybersecurity Expert, CYE,  7/9/2021
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
Everything You Need to Know About DNS Attacks
It's important to understand DNS, potential attacks against it, and the tools and techniques required to defend DNS infrastructure. This report answers all the questions you were afraid to ask. Domain Name Service (DNS) is a critical part of any organization's digital infrastructure, but it's also one of the least understood. DNS is designed to be invisible to business professionals, IT stakeholders, and many security professionals, but DNS's threat surface is large and widely targeted. Attackers are causing a great deal of damage with an array of attacks such as denial of service, DNS cache poisoning, DNS hijackin, DNS tunneling, and DNS dangling. They are using DNS infrastructure to take control of inbound and outbound communications and preventing users from accessing the applications they are looking for. To stop attacks on DNS, security teams need to shore up the organization's security hygiene around DNS infrastructure, implement controls such as DNSSEC, and monitor DNS traffic
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2023-33196
PUBLISHED: 2023-05-26
Craft is a CMS for creating custom digital experiences. Cross site scripting (XSS) can be triggered by review volumes. This issue has been fixed in version 4.4.7.
CVE-2023-33185
PUBLISHED: 2023-05-26
Django-SES is a drop-in mail backend for Django. The django_ses library implements a mail backend for Django using AWS Simple Email Service. The library exports the `SESEventWebhookView class` intended to receive signed requests from AWS to handle email bounces, subscriptions, etc. These requests ar...
CVE-2023-33187
PUBLISHED: 2023-05-26
Highlight is an open source, full-stack monitoring platform. Highlight may record passwords on customer deployments when a password html input is switched to `type="text"` via a javascript "Show Password" button. This differs from the expected behavior which always obfuscates `ty...
CVE-2023-33194
PUBLISHED: 2023-05-26
Craft is a CMS for creating custom digital experiences on the web.The platform does not filter input and encode output in Quick Post validation error message, which can deliver an XSS payload. Old CVE fixed the XSS in label HTML but didn’t fix it when clicking save. This issue was...
CVE-2023-2879
PUBLISHED: 2023-05-26
GDSDB infinite loop in Wireshark 4.0.0 to 4.0.5 and 3.6.0 to 3.6.13 allows denial of service via packet injection or crafted capture file