San Francisco International Airport discloses data breach after hack

guest · Apr 10, 2020

San Francisco Intl Airport discloses data breach after hack
April 10, 2020
https://www.bleepingcomputer.com/ne...ntl-airport-discloses-data-breach-after-hack/

San Francisco International Airport (SFO) disclosed a data breach after two of its websites, SFOConnect.com and SFOConstruction.com, were hacked during March 2020.

According to a notice of data breach sent to all SFO Airport commission employees via an internal memo, the attackers may have gained access to the login credentials of users registered on the two breached sites.
SFO is also a major gateway to Europe and Asia with flights to over 50 international cities via 45 international carriers.
Attackers injected malicious code to steal credentials
After investigating the incident, SFO discovered that the attackers might have gained access to the affected users' usernames and passwords.

"The airport also forced a reset of all SFO related email and network passwords on Monday, March 23, 2020," the data breach alert adds.
Click to expand...

guest · Apr 14, 2020

Russian hackers tried to steal San Francisco airport Windows accounts
April 14, 2020
https://www.bleepingcomputer.com/ne...steal-san-francisco-airport-windows-accounts/

The hack of employee web sites belonging to the San Francisco International Airport has been attributed to a Russian hacker group who used the SMB protocol to steal Windows passwords.

At the time, it was not known precisely how this was being done, but new information posted on Twitter by cybersecurity firm ESET sheds some light on the attack and how it was used to target Windows logins.
According to ESET's tweet, after hacking into the SFO employee sites SFOConnect.com and SFOConstruction.com, the attackers added JavaScript that injects a 1x1 image into the HTML whose source was located on a remote server operated by the attackers.

When this is done, by default Windows will send the logged-in user's Windows account name and their hashed password during NTLM authentication.
Click to expand...

As a safety measure, SFO has forced a reset of all network and email passwords on Monday, March 23, 2020.
TTPs used by Dragonfly/Energetic Bear APT group
ESET has stated that this attack corresponds with the tactics, techniques and procedures (TTPs) of the Russian attributed APT hacking group known as Dragonfly/Energetic Bear.

According to ESET, this group has been in operation since 2010 and have historically targeted industrial and energy companies in the USA and Europe.
Click to expand...

Log in or Sign up

San Francisco International Airport discloses data breach after hack

guest Guest

guest Guest

Log in or Sign up

San Francisco International Airport discloses data breach after hack

guest Guest

guest Guest

Useful Searches