Story image

FireEye data leaks continue - or are the hackers just trolling?

15 Aug 2017

Hackers have released another batch of information supposedly belonging to cybersecurity firm FireEye, two weeks after they were able to compromise a FireEye researcher’s social media accounts.

According to reports, the hackers published another PasteBin dump, which accuses FireEye of a coverup.

“Well we were waiting FireEye for a public comment and FireEye lied again, and they lied in cost of their customers. They did a mistake. They knew we had access to JIRA, Their IDF workshop wasn't a part of Adi Peretz's job. They knew Adi Peretz wasn't working on Bank Hapoalim," The PasteBin dump says.

"They said our documents was "public", are license files, private contract documents, private IDF workshops and internal network topologies public? If they weren't public why did you removed our files and from public file hosting? Why did you removed our first Pastebin message? They knew the truth and they're hiding it from their customers and the public,” it continues.

The data dumps apparently contain Cisco licences, Illusive’s confidential report, a ClearSky document and more – but Twitter reports suggest there isn’t much to the files.

The hackers have also taken to using hashtags on social media, under the name #leaktheanalyst. Debate has surfaced about the legitimacy of the files and whether the hackers are simply on a trolling mission.

Last week FireEye’s Steven Booth posted a blog in which he states FireEye’s networks were not breached, although that wasn’t for lack of trying.

The researcher, a Mandiant employee who was hacked, however, had in fact been a victim of other third party breaches, including the LinkedIn breach that happened last year.

The hackers didn’t get access to the victim’s personal or corporate computers, although Booth says the attacker did release three corporate FireEye documents using information from the victim’s corporate online accounts.

“All of the other documents released by the attacker were previously publicly available or were screen captures created by the attacker. A number of the screen captures created by the Attacker and posted online are misleading, and seem intentionally so. They falsely implied successful access to our corporate network, despite the fact that we identified only failed login attempts from the attacker,” Booth says.

Booth says that after the breach was discovered, FireEye contacted the victim and identified customers named in the breach, disabled the victim’s corporate accounts and send a message to all employees to be vigilant about their personal accounts.

“We understand the trust our customers place in FireEye, and we will continue to do all we can to earn and keep that trust. We will also engage with law enforcement and intelligence agencies as appropriate, as we routinely do to identify and prosecute cyber criminals. We thank you for your support during this ongoing investigation,” Booth says in the blog.

Seagate: Data trends, opportunities, and challenges at the edge
The development of edge technology and the rise of big data have brought many opportunities for data infrastructure companies to the fore.
Popular Android apps track users and violate Google's policies
Google has reportedly taken action against some of the violators.
How blockchain could help stop video piracy in its tracks
An Australian video tech firm has successfully tested a blockchain trial that could end up being a welcome relief for video creators and the fight against video piracy.
IBM X-Force Red & Qualys introduce automated patching
IBM X-Force Red and Qualys are declaring a war on unpatched systems, and they believe automation is the answer.
Micro Focus acquires Interset to improve predictive analytics
Interset utilises user and entity behavioural analytics (UEBA) and machine learning to give security professionals what they need to execute threat detection analysis.
Raising the stakes: McAfee’s predictions for cybersecurity
Security teams and solutions will have to contend with synergistic threats, increasingly backed by artificial intelligence to avoid detection.
Exclusive: Ping Identity on security risk mitigation
“Effective security controls are measured and defined by the direct mitigation of inherent and residual risk.”
CylancePROTECT now available on AWS Marketplace
Customers now have access to CylancePROTECT for AI-driven protection across all Windows, Mac, and Linux (including Amazon Linux) instances.