Clinton Campaign Voter Records Breached; Hackers Invade Juniper Networks, & Pickpocket Bubba Gump Patrons

In case you missed our coverage this week in ThreatWatch, Nextgov’s regularly updated index of cyber breaches: 

Payment Thieves Breach Restaurateur That Owns Bubba Gump, Morton's, Others

Banking industry sources say that fraud patterns on cards issued to restaurant customers strongly suggest a payment system hack at Houston-based Landry’s, the operator of more than 500 properties, such as Landry’s Seafood, Chart House and Rainforest Cafe. 

The problem appears to have started in May and may still be active at some Landry’s locations.

An online FAQ about the incident posted to Landry’s site says the company does not yet know the extent of the breach.

Thieves in possession of the data would be able to encode it onto new plastic and use the counterfeit cards at big box retailers like Best Buy. Banking industry sources say they are now seeing fraudulent purchases at such stores on cards that all were used at the likely compromised Landry’s locations.

Sanders Staff Improperly Accessed Clinton Voter Data at Length

At least four individuals affiliated with the Bernie Sanders presidential campaign conducted searches of and saved the Hillary Clinton campaign's confidential lists of potential voters over a period of more than 40 minutes, documents show.

The database breach is related to a software error at the technology company NGP VAN, which provides campaigns with voter data. As a result of the glitch, "all users on the system across the Democratic campaigns were inadvertently able to access some data belonging to other campaigns for a brief window," Democratic National Committee spokesman Luis Miranda said.

DNC Chair Debbie Wasserman Schultz said the allegation is that the Sanders staffer or staffers accessed the Clinton campaign's voter-file information, exported it and downloaded it.

Sanders campaign National data Director Josh Uretsky and Deputy National Data Director Russell Drapkin allegedly are two of the staffers who improperly opened the data. 

An audit trail indicates data was saved to personal folders.

It also appears that Drapkin "suppressed" two folders after the database company became aware of the breach.

Uretsky said that he takes responsibility for the incident but that he did not believe accessing the data was wrong.

"We didn't use [the data] for anything valuable and we didn't take custodianship of it," Uretsky said, arguing that he was trying to document the existence of the security breach but not exploit it.

"It's like if somebody leaves the front door open and you left a note inside the front door saying 'you left the door open,'' and then maybe you would check the side door to make sure that door was closed," he said.

Security Bugs in Widely-Used Juniper System Might Have Been Planted by Foreigners

There is a concern that hackers working for a nation state were able to spy on the encrypted communications of the federal government and companies for the past several years.

The breach involved hackers installing a backdoor on computer equipment, U.S. officials told CNN.

Juniper disclosed the existence of the security vulnerabilities on Dec. 17, and issued an emergency security patch.

The security fix is intended to seal the backdoor, which the attackers created in order to remotely log into commonly used VPN networks to eavesdrop on communications that were supposed to be secure.

Department of Homeland Security officials are now trying to determine how many affected systems are in use on federal networks.

U.S. officials said it's not clear how the Juniper source code was altered, whether by an outside attacker or an insider.  

One U.S. official described the situation as akin to "stealing a master key to get into any government building."

The work to alter millions of lines of source code is sophisticated. The program was compromised for three years before Juniper uncovered it during a routine review in recent weeks.

Jokesters Attack European Space Agency Systems

Hackers out for laughs claim to have breached personal data and computer system records at ESA.

Once the hacktivist group, which associates itself with Anonymous, copied the records, it posted the material onto a public document server and shared it among various people online.

The group broke in through the common technique of exploiting a “blind SQL vulnerability” website code flaw, which provided them further access to the site’s database. 

A post accompanying the breached data says the ESA attack was for amusement (lulz) only.

Along with database schemas and server stats, a second post also included 8,107 names, email addresses, and passwords. A third post exposed contact details for various ESA supporters and researchers.