Carlson hotel in Minnetonka has launched its hotel's rewards point system called "Club Carlson Gold Points " , Recently hackers compromised into its security. According to the Hotel Officials , About $35,000 of the worth of rewards of 650 customers has been stolen by hackers.
The company noticed irregular transaction to a club members accounts 12 days ago. Company says that when they noticed the transactions , they immediately freeze the accounts.
All of the members who have been affected and have been contacted and their stolen rewards has been replaced. The company is urging the members which had access to Club Carlson's account to check their balance and change their passwords.
The accounts didn't contained any financial information , it only included the addresses of the members and their email addresses according to the company as they are saying. This case is still under investigation.
.jpg)
Are you safe from the critical bug Heartbleed?? OpenSSL- the encryption technology used by millions of websites to encrypt the communication and is also used to protect our sensitive data such as e-mails, passwords or banking information. But a tiny, but most critical flaw called "Heartbleed" in the widely used OpenSSL opened doors for the cyber criminals to extract sensitive data from the system memory.SSL and TLS are known to provide communication security and privacy over the Internet for applications such as websites, email, instant messaging (IM), including some virtual private networks (VPNs).Heartbleed is a critical bug (CVE-2014-0160) is in the popular OpenSSL cryptographic software library, that actually resides in the OpenSSL's implementation of the TLS (transport layer security protocols) and DTLS (Datagram TLS) heartbeat extension (RFC6520).This bug was independently discovered by a team of security engineers (Riku, Antti and Matti) at Codenomicon, while improving the SafeGuard feature in Codenomicon's Defensics security testing tools, and Neel Mehta of Google Security, who first reported it to the OpenSSL team.Software vulnerabilities may come and go, but this bug is more critical as it has left the large number of private keys and other secrets exposed to the Internet. The heartbleed bug can reveal the contents of a server's memory, where the most sensitive data is stored, including the private data such as usernames, passwords, and credit card numbers. This could allow attackers to retrieve private keys and ultimately decrypt the server's encrypted traffic or even impersonate the server.
Yahoo, which has more than 800 million users around the world, also has been exposed by the bug.
Cyber intelligence company, IntelCrawler also published a report, which revealed that cybercriminals specialized in cyber espionage attacks are using this zero-day vulnerability in the wild to target several aerospace corporations, military subcontractors, embassies, as well as Fortune Global 500 companies.Using this technique, an attacker can drop any malware in very convincing manner to the victim's system. "Using this method the bad actors bypass some specific security measures including e-mail server’s antivirus systems" IntelCrawler said.Danor successfully exploited winrar version 4.20, and IntelCrawler confirmed that the vulnerability also works on all WinRar versions including v.5.1. 
In above example, the Malware archive file was password protected to avoid antivirus detection, used in an ongoing targeted cyber espionage campaign. 
When it comes to Information Security, there's a great way to learn, train and keep sharp your skills. This can be done using gamification mechanics to speed up the learning curve and improve retention rate. Capture The Flag competitions use gamification mechanics and represent one of the best ways to learn security hands on. 
The Distributed Denial of Service (DDoS) attack has become more sophisticated and complex and therefore has become one of favorite weapon for the cyber criminals to temporarily suspend the services of any host connected to the Internet and till now nearly every big site had been a victim of this attack, from WordPress to online game websites.According to the new report released by a US based security solutions provider Incapsula, DDOS activities have become threefold since the start of the year 2013, pointing the key source of trash traffic to be the remotely controlled “zombie army” that can be used to flood various websites for DDoS attacks and other malicious activities.The report site as “DDOS Threat Landscape”, explains that almost one in every three DDoS attacks is above 20Gbps and 81% of attacks feature multiple vector threats.
