NEWS EA-Server-Hack & Phishing nach Apple IDs - Update 20.03: Problem behoben

Unbekannte haben sich, vermutlich über eine Sicherheitslücke in einer veraltete WebCalendar-Software (aus dem Jahr 2008), Zugriff auf zwei EA-Server verschafft und versuchen nun Apple IDs (Name, Mail, Passwort, Kreditkartendaten, etc.) der Nutzer abzugreifen.

The compromised server is used by two websites in the ea.com domain, and is ordinarily used to host a calendar based on WebCalendar 1.2.0. This version was released in September 2008 and contains several security vulnerabilities which have been addressed in subsequent releases.

Zum Vergrößern anklicken....

The phishing site attempts to trick a victim into submitting his Apple ID and password. It then presents a second form which asks the victim to verify his full name, card number, expiration date, verification code, date of birth, phone number, mother's maiden name, plus other details that would be useful to a fraudster.

Zum Vergrößern anklicken....

Laut Newsquelle wurde das "Problem" zwar schon an EA weitergeleitet, aber die modifizierten Server sind aktuell noch immer online. Vorsicht also bei allen Loginvorgängen und Dateneingaben auf EA-Seiten.

informed EA yesterday that their server has been compromised. However, the vulnerable server — and the phishing content — is still online at the time of publication

Zum Vergrößern anklicken....

Möglich ist auch, dass die Angreifer auf weitere Daten auf dem Server Zugriff haben. Wer also auch bei anderen Diensten das EA-Passwort verwendet sollte dies dort zuerst ändern und später, wenn die EA-Server wieder "sauber" sind, auch beim EA-Account.

Quelle: http://news.netcraft.com/archives/2014/03/19/ea-games-website-hacked-to-steal-apple-ids.html


Update 20.03: EA hat das Problem behoben:

EA said that it had located the issue and was working to ensure that the vulnerability will no longer be exploitable. "We found it, we have isolated it, and we are making sure such attempts are no longer possible," a company spokesperson said.

Zum Vergrößern anklicken....

http://www.theverge.com/2014/3/19/5...ting-phishing-site-for-apple-ids-credit-cards

Na super...

Anscheinend haben wir hier nicht viele Apple User, daher ist der Thread so leer !

Update 20.03: EA hat das Problem behoben:

EA said that it had located the issue and was working to ensure that the vulnerability will no longer be exploitable. "We found it, we have isolated it, and we are making sure such attempts are no longer possible," a company spokesperson said.

Zum Vergrößern anklicken....

http://www.theverge.com/2014/3/19/5...ting-phishing-site-for-apple-ids-credit-cards

Also zur Sicherheit das EA-PW ändern.