Fourth person arrested over TalkTalk hacking attack

[Scubbie]

Fourth person arrested over TalkTalk hacking attack - BBC News

Police have made a fourth arrest, of a 16-year-old boy, in connection with the investigation into an alleged data theft from TalkTalk.

He was held on suspicion of Computer Misuse Act offences after officers searched an address in Norwich.

Police have also arrested and bailed a 16-year-old from London, a 15-year-old boy in County Antrim, Northern Ireland, and a man, 20, from Staffordshire.

The TalkTalk website was hit by a "significant" hacking attack last week.

On Friday, the phone and broadband provider confirmed that at most 1.2 million email addresses, names and phone numbers and 21,000 unique bank account numbers and sort codes were accessed in the attack.

It was fewer than originally thought, the firm said.

The company, which has more than four million UK customers, said it would be writing to all affected people to let them know what information had been accessed.

It said that any stolen credit or debit card details were incomplete - and therefore could not be used for financial transactions - but advised customers to remain vigilant against fraud.

The fourth arrest in connection with the attack came after detectives from the Metropolitan Police Cyber Crime Unity and the National Crime Agency executed a search warrant at the Norwich address, the Met said.

The 16-year-old remains in custody at a local police station.

What should you do if you think you're at risk?

• Report any unusual activity on your accounts to your bank and, if you are in England, Wales or Northern Ireland, to the national fraud and internet crime reporting centre Action Fraud on 0300 123 2040 or www.actionfraud.police.uk. If you are in Scotland, call Police Scotland
• TalkTalk is advising customers to change their account password as soon as its website is back up and running and any other accounts for which you use the same password
• Beware of scams: TalkTalk will not call or email customers asking for bank details or for you to download software to your computer, or send emails asking for you to provide your password

TalkTalk hack: What should I do?

Also: Be Aware of Fraud.pdf

Further coverage:

UPDATE Government Inquiry as Fourth Person Arrested for TalkTalk Hack - ISPreview UK

UPDATE Government Inquiry as Fourth Person Arrested for TalkTalk Hack

British police have arrested a fourth person, a 16 year old boy from Norwich, in connection with the recent cyber-attack on TalkTalk’s website (here), which resulted in the personal details of 1.2 million broadband ISP customers being stolen by Internet criminals.

The attack itself, which appeared to combine a Distributed Denial of Service (DDoS) assault and later an SQL Injection exploit against the ISP’s website, has kept the ISP’s online ordering system offline for nearly two weeks. Further details about exactly what was stolen from TalkTalk’s servers were revealed last week (here).

Other than yesterday’s event the police have also arrested another 16-year-old boy in west London, a 15-year-old boy in Northern Ireland and a 20-year-old man from Staffordshire in central England; all under the Computer Misuse Act. So far three of those have been released on bail pending a further hearing.

At this stage it’s unclear whether all of those who have been arrested are directly connected to the hack itself or merely got caught up in the aftershocks, such as by sharing the database in public. The investigation continues.

UPDATE 10:31am

The Culture, Media and Sport Commons Select Committee have today launched an inquiry into cyber security following the recent hack of TalkTalk’s website, which will also examine any wider implications for the ISP and telecoms market.

Jesse Norman MP, Chair of the Committee, said:

“The recent events have highlighted serious issues relating both to existing cyber-security and the response to cyber-crime. This Committee is concerned with the attacks on TalkTalk specifically as a telecoms and internet service provider, but with the recent move of the Information Commissioner’s Office to DCMS, we will also be looking more widely at the security of personal information online.”

The Committee is seeking views on following areas:

• The nature of the cyber-attacks on TalkTalk’s website and TalkTalk’s response to the latest incident.
  
• The robustness of measures that telecoms and internet service providers are putting in place to maintain the security of their customers’ personal data and the level of investment being made to ensure their systems remain secure and anticipate future threats.
  
• The nature, role and importance of encryption in protecting personal data.
  
• The adequacy of the supervisory, regulatory and enforcement regimes currently in place to ensure companies are responding sufficiently to cyber-crime.
  
• The adequacy of the redress mechanisms and compensatory measures for consumers when security breaches occur and individuals’ personal data are compromised
  
• Likely future trends in hacking, technology and security.

The deadline for written submissions is Monday 23rd November 2015 and you can find more details on the Government’s website (here).

[Isitme]

Been away while this was happening but I wonder if the recent attack we suffered on this forum was a practice run for the main attempt. Sky may have blocked them, so they turn to TT.

[marjohn56]

It was obviously muppets who attacked this site then if they thought this was the Sky site. A little browsing first would have shown them it wasn't. It states quite clearly 'The Unofficial Support Forum for everything Sky'

[Scubbie]

The vBulletin site was recently attacked too, so whoever had a go here may have been attacking other vBulletin based forums too. As a result the vBulletin site has reset all passwords.

Thankfully Ged had blocked the hole which they were attempting to use to get in on this forum.

As for the hackers of TalkTalk, it looks like these were after a different goal. Attempting to blackmail TT was probably their final mistake, but it does appear that the Police are nailing them one at a time.

[Isitme]

Comes as a bit of a surprise that these cyber terrorists are home grown and not from some East European country. Let's hope they have the right culprits and these are not just fall guys.

[marjohn56]

And what is the average age?

However, if they are the real hackers, and I suspect they are only part of a 'team' they'll get 60 hours community service and told not to be bad boys... sigh..

BRING BACK THE CAT 'O' NINE TAILS I SAY!!

[Scubbie]

The Cat-O-Nine-Tails is tame.

...compared to the ones listed on this site: http://list25.com/25-most-brutal-tor...-ever-devised/

If you think number 24 is getting warm, then keep reading. Numbers 15 & 11 should disable their ability to communicate over the Internet.

Number 4 is quite appropriate for today's date. Number 2 would be suitable for many found guilty of a sex crime. Apparently you don't get many repeat offenders either.

However number one would get my vote or those who insist on hacking or taking advantage of people by fraudulently calling them in order to take money from their accounts.

[marjohn56]

@Scubbie

Just a tad excessive if you don't mind me saying so.

However, I get your drift!

Perhaps just chopping off one hand would slow the hackers down, but then again... perhaps you are right.

Let's just bring back public flogging.

[Scubbie]

My favourite was a news report whilst I was working in Egypt. I'll never know just how true it was but it should discourage some people if it were brought in to the UK...

There is a report that last night police pulled over a man due to his erratic driving. When the police officer approached the driver he could smell alcohol on his breath. The driver argued over whether or not he was drunk and managed to get out of the car.

The driver refused to provide a breath test.

At this point he started to become violent, at which point the police officer drew his gun. The drunken driver continued to argue with the officer and became more violent.

The officer shot him. Dead.

Case closed.

I mean, what's wrong with that? No repeat offenders. Suddenly the rate of drink related offences drop to an all-time low.

[marjohn56]

Actually, I'm sure public flogging would reduce re-offending and thus save a lot of money with regards to prison etc. That money could be invested in the NHS, so it's a win win situation.

They could also auction off the job of 'flogger' for an hour, no longer than that, as I suspect I for example would 'put my back into it' and get tired quite quickly; again the money raised could go to good causes.

Shall we have a poll?