#1 Trusted Cybersecurity News Platform Followed by 4.50+ million
The Hacker News Logo
Get the Free Newsletter
SaaS Security

Backdoor | Breaking Cybersecurity News | The Hacker News

Government launched 'China Operating System' (COS) to break Andoird and iOS Monopoly

Government launched 'China Operating System' (COS) to break Andoird and iOS Monopoly

Jan 22, 2014
China has always tried to support its homegrown tech industry and even the security concerns over U.S. secret surveillance which gives Chinese Government another reasons to trust domestic vendors.Many other countries are also in favor to develop their own technology industries to reduce their dependence on U.S. The Government of China is not too fond of foreign mobile operating systems and therefore are trying to break the monopoly of Microsoft, Apple and Google in the country. This week at an event in  Beijing,  China has unveiled its own Linux-based mobile platform, dubbed China Operating System (COS) , developed as a joint effort between a company ' Shanghai Liantong ', ISCAS ( Institute of Software at the Chinese Academy of Sciences ) and the Chinese Government. According to  COS website , it is designed for PCs, Smartphones, tablets, TVs, set-top boxes and other smart appliances. It runs Java applications, supports HTML5 and can run over 100,000 apps. At
Cisco released Security advisory for critical Router password reset vulnerability

Cisco released Security advisory for critical Router password reset vulnerability

Jan 14, 2014
In the first week of this year, we have reported about a critical vulnerability found in more than 2000 Routers that allow attackers to reset the admin panel password to defaults. Recently, Cisco has released a security advisory , detailed about the similar vulnerability affecting their three networking products. Cisco has rated the flaw highly critical and marked it as 10.0 on the Common Vulnerability Scoring System (CVSS). A security researcher found a secret service listening on port 32764 TCP, allowed a remote user to send unauthenticated commands to the device and reset the administrative password. Successful exploitation of the vulnerability allows the hacker to execute arbitrary commands on the device with escalated privileges. Vulnerable Cisco products are: WAP4410N Wireless-N Access Point, Cisco WRVS4400N Wireless-N Gigabit Security Router, and the Cisco RVS4000 4-port Gigabit Security. "This vulnerability is due to an undocumented test interface in t
Making Sense of Operational Technology Attacks: The Past, Present, and Future

Making Sense of Operational Technology Attacks: The Past, Present, and Future

Mar 21, 2024Operational Technology / SCADA Security
When you read reports about cyber-attacks affecting operational technology (OT), it's easy to get caught up in the hype and assume every single one is sophisticated. But are OT environments all over the world really besieged by a constant barrage of complex cyber-attacks? Answering that would require breaking down the different types of OT cyber-attacks and then looking back on all the historical attacks to see how those types compare.  The Types of OT Cyber-Attacks Over the past few decades, there has been a growing awareness of the need for improved cybersecurity practices in IT's lesser-known counterpart, OT. In fact, the lines of what constitutes a cyber-attack on OT have never been well defined, and if anything, they have further blurred over time. Therefore, we'd like to begin this post with a discussion around the ways in which cyber-attacks can either target or just simply impact OT, and why it might be important for us to make the distinction going forward. Figure 1 The Pu
Potential backdoors discovered in US-based components used by French Satellites

Potential backdoors discovered in US-based components used by French Satellites

Jan 07, 2014
United Arab Emirates (UAE) may terminate a $930 Million USD contract with France based companies for the supply of two two military Imaging satellites  due to the discovery of several US produced components in them. Now the deal is in danger because the UAE claims it has discovered backdoors in the  components  which are manufactured in the United States , reported by the Defense News . The contract, sealed in July 2013, includes a ground station, the Pleiades-type satellites (aka Falcon Eye) are due for delivery 2018. The revelation was provided by high-level UAE sources, the companies involved in the business are the prime contractor Airbus Defense and Space, and payload maker Thales Alenia Space. " If this issue is not resolved, the UAE is willing to scrap the whole deal ," he added. UAE authorities suspect the presence of vulnerabilities would " provide a back door to the highly secure data transmitted to the ground station ". An unnamed UAE source has confirmed that the pres
cyber security

Automated remediation solutions are crucial for security

websiteWing SecurityShadow IT / SaaS Security
Especially when it comes to securing employees' SaaS usage, don't settle for a longer to-do list. Auto-remediation is key to achieving SaaS security.
Hacking Wireless DSL routers via Administrative password Reset Vulnerability

Hacking Wireless DSL routers via Administrative password Reset Vulnerability

Jan 04, 2014
If you want to hack a Netgear and Linkys Wireless Routers , there is a quick backdoor entry available, that allow an attacker to reset the admin panel password to defaults. Eloi Vanderbeken , a hacker and reverse-engineer from France has discovered an administration password Reset vulnerability in many Netgear and Linkys Routers. In a blog post , Eloi said that During Christmas Holidays he forgot the admin interface password of his Linksys WAG200G router and in an effort to gain access back of its administration panel, he first scanned the Router and found a suspicious open TCP port i.e. 32764. To do further research on this port service, he downloaded a copy Linksys firmware and reverse-engineered it. He found was a secret backdoor interface that allowed him to send commands to the router from a command-line shell without being authenticated as the administrator. Then he blindly tested commands, but doing so flips the router's configuration back to factory settings with defau
Hackers stole money from European ATMs using Malware-loaded USB Device

Hackers stole money from European ATMs using Malware-loaded USB Device

Jan 02, 2014
Hacking ATM Machines is nothing new, but it seems that instead of relying on ATM skimmers now some smart hackers in Europe are reportedly targeting ATM Machines using Malware -loaded USB drives to steal money. Most of the world's ATMs are running on Windows XP operating system, which is highly vulnerable to Malware attacks. Just like your Desktop Laptops, some ATMs also have USB sockets, which is hidden behind the ATM's fascia. The German security researchers who discovered the hack detailed their findings at the Chaos Computing Congress in Hamburg, Germany recently. They said that the thieves cut holes in the fascia to access a USB port and then uploaded malware to the machines. The malware creates a backdoor that can be accessed on the front panel. " These researchers explained that the malware allowed the thieves to create a unique interface on the ATMs by typing in a 12-digit code. This interface allowed for withdrawal and also showed the criminals the amount of money and e
Java based Cross platform malware targeting Apache Tomcat servers in the wild

Java based Cross platform malware targeting Apache Tomcat servers in the wild

Nov 21, 2013
Takashi Katsuki, a researcher at Antivirus firm Symantec has discovered a new cyber attack ongoing in the wild, targeting an open-source Web server application server Apache Tomcat with a cross platform Java based backdoor that can be used to attack other machines. The malware, dubbed as " Java.Tomdep " differs from other server malware and is not written in the PHP scripting language. It is basically a Java based backdoor act as Java Servlet that gives Apache Tomcat platforms malicious capabilities. Because Java is a cross platform language, the affected platforms include Linux, Mac OS X, Solaris, and most supported versions of Windows. The malware was detected less than a month ago and so far the number of infected machines appears to be low. You may think that this type of attack only targets personal computers, such as desktops and laptops, but unfortunately that isn't true. Servers can also be attacked. They are quite valuable targets, since they are usu
Backdoor found in Chinese Tenda Wireless Routers, allows Root access to Hackers

Backdoor found in Chinese Tenda Wireless Routers, allows Root access to Hackers

Oct 19, 2013
Last week Craig Heffner, specialized on the embedded device hacking exposed a serious backdoor in number of D-Link routers allows unauthorized backdoor access. Recently he published his another researcher, Titled ' From China, With Love ', exposed that D-Link is not only the vendor who puts backdoors in their products. According to him, China based networking device and equipment manufacturer - Tenda Technology  (www.tenda.cn) also added potential backdoors into their Wireless Routers. He unpacked the software framework update and locate the httpd binary an found that the manufacturer is using GoAhead server, which has been substantially modified. These routers are protected with standard Wi-Fi Protected Setup (WPS) and WPA encryption key, but still by sending a UDP packet with a special string , an attacker could take over the router. Routers contain a flaw in the httpd component, as the MfgThread() function spawns a backdoor service that listens fo
Unauthorized Access Backdoor found in D-Link router Firmware Code

Unauthorized Access Backdoor found in D-Link router Firmware Code

Oct 14, 2013
A number of D-Link routers reportedly have an issue that makes them susceptible to unauthorized backdoor access . The researcher Craig, specialized on the embedded device hacking - demonstrated the presence of a backdoor within some DLink routers that allows an attacker to access the administration web interface of network devices without any authentication and view/change its settings. He found the backdoor inside the firmware v1 . 13 for the DIR-100 revA . Craig found and extracted the SquashFS file system loading firmware's web server file system (/bin/webs) into IDA.  Giving a look at the string listing, the Craig's attention was captured by a modified version of thttpd , the thttpd - alphanetworks /2.23, implemented to provide the rights to the administrative interface for the router.  The library is written by Alphanetworks, a spin-off company of D-Link, analyzing it Craig found many custom functions characterized by a name starting with suffix "alpha"
Integrated circuits can be compromised using Undetectable hardware Trojans

Integrated circuits can be compromised using Undetectable hardware Trojans

Sep 21, 2013
A team of researchers from the U.S. and Europe has developed a Hardware Trojan , which is an undetectable to many techniques, raising the question on need of proper hardware qualification.  They  released a paper on stealthy Dopant-Level Hardware Trojans, showing how integrated circuits used in computers, military equipment and other critical systems can be maliciously compromised during the manufacturing process. " In this paper we propose an extremely stealthy approach for implementing hardware Trojans below the gate level, and we evaluate their impact on the security of the target device. Instead of adding additional circuitry to the target design, we insert our hardware Trojans by changing the dopant polarity of existing transistors. " states the paper abstract. The Scientists devised two such backdoors they said adversaries could feasibly build into processors to surreptitiously bypass cryptographic protections provided by the computer running the chips
U.S. Government asked Linus Torvalds to insert Backdoor Into Linux

U.S. Government asked Linus Torvalds to insert Backdoor Into Linux

Sep 19, 2013
At the Linuxcon conference in New Orleans today, Linus Torvalds and the other top Linux developers, talked to the Linux faithful about Linux, Microsoft, and other issues. During a question-and-answer ‪session ‬at ‪the LinuxCon,  Linux Torvalds admitted to questions from the audience th at the  U .S. Government   approached him to put a backdoor into his open-source operating system. Torvalds responded "no" while shaking his head "yes," as the audience broke into spontaneous laughter. Then someone asked if Linus would be interested in becoming Microsoft's CEO, which was answered with a big smile and because he is fully satisfied with the development of Linux and his life. He noted that when he started Linux 22 years ago, the hardware was very different than it is today. He expects that 20 years from now the hardware will change even more. " Linux usage keeps changing. Linux today is very different from even ten years ago ," Torvalds ad
Bitcoins - Secured by NSA designed Encryption or Backdoored ?

Bitcoins - Secured by NSA designed Encryption or Backdoored ?

Sep 13, 2013
It's been nearly three months since Edward Snowden started telling the world about the National Security Agency's mass surveillance of global communications. After the last week report that the National Security Agency has leveraged its cooperative relationships with specific industry partners to insert vulnerabilities into Internet security products. Bitcoin , a virtual currency, a peer-to-peer electronic cash system, which is generated on a logarithmic scale by dedicated miners who run software that generate the complex hash codes which make up a Bitcoin.  The integrity of Bitcoin depends on a hash function called SHA-256 , which was designed by the NSA and published by the National Institute for Standards and Technology (NIST). Is it hard to believe that could the intelligence community have a secret exploit for Bitcoin? While there is no evidence yet to support the speculation. " If you assume that the NSA did something to SHA-256, which no outside resea
NSA: Steve Jobs is the real Big Brother and iPhone buyers are zombies

NSA: Steve Jobs is the real Big Brother and iPhone buyers are zombies

Sep 10, 2013
As we reported yesterday that, your Smartphone is a goldmine for the US National Security Agency (NSA), they have the full access to your Data available on your Smartphones including Android , iPhone and Blackberry. But among other Smartphones,  iPhone apparently is the most popular with the National Security Agency. Another NSA presentation leaked by NSA whistle-blower Edward Snowden and published by German paper Der Spiegel , describing Steve Jobs as the real Big Brother and iPhone buyers as the "zombies" . By cracking mobile operating systems and eavesdropping on mobile communications, the data obtained in this way includes contacts, call lists, SMS traffic, notes and location information. " Such as a iPhone picture of a foreign government official who took selfies while watching TV, and a picture of an unknown man, apparently an Afghani fighter, in the mountains of Afghanistan. And remember the iPhone's location bug? That enabled tracking of people over exten
Chinese computer maker Lenovo banned by Spy Agencies

Chinese computer maker Lenovo banned by Spy Agencies

Jul 29, 2013
According to a new report, the world's biggest personal computer maker, Chinese firm Lenovo Group Limited has reportedly been banned from supplying equipment for  networks of the intelligence and defense services of Australia, the United States, Britain, Canada and New Zealand, due to hacking concerns. Sources from intelligence and defense entities in the UK and Australia have confirmed the ban introduced in the mid-2000s after intensive laboratory testing of its equipment. In 2006 it was disclosed that the US State Department had decided not to use 16,000 new Lenovo computers on classified networks because of security concerns. Serious backdoor vulnerabilities in hardware and firmware were apparently discovered during the tests which could allow attackers to remotely access devices without the knowledge of the owner. Lenovo, headquartered in Beijing, acquired IBM's personal computer business in 2005, after which IBM continued to sell servers and mainframes that we
Beware of Fake Android Antivirus and Mobile Ransomware

Beware of Fake Android Antivirus and Mobile Ransomware

Jul 14, 2013
" Ransomware " may be a term you haven't heard before. This type of criminal malware, which spread around the world on PCs in 2012, encrypts some or all the files on a computer and holds them for ransom and  Cyber thieves have already made millions through such methods. Ransomware is no longer all about computers. It has evolved to now target mobile devices, specifically Androids platform. For a hacker, a pop up message is just one more way to steal money by sending fake alerts and serious warnings that scare a user into making a payment. For example, in the case of PCs, we have encountered malware that encrypts crucial data on a user's hard disk, asking the victim to pay a sum to the attacker in order to recover his/her data. Last year in November at many Hacking Conferences, Security Researcher Mohit Kumar ( @Unix_Root ) already demonstrated one the most sophisticated android malware called " Android Malware Engine ", one of its kind yet
Researchers uncovered new malware used by Chinese cyber criminals

Researchers uncovered new malware used by Chinese cyber criminals

May 10, 2013
Trend Micro researchers have uncovered a new backdoor pieces of malware from the Winnti family, which are mainly used by a Chinese  cyber criminal group to target South East Asian organizations from the video gaming sector. Winnti malware used by hackers to hijack control of web users systems using a new backdoor contained in the legitimate Aheadlib analysis tool. Dubbed as " Bkdr_Tengo.A, " passes itself off as a legitimate system DLL file called winmm.dll. " We believe that this was done using a legitimate tool called Aheadlib, which is a legitimate analysis tool. "  wrote Trend Micro's Eduardo Altares. " The file is not encrypted and neither was it particularly hard to analyze. Its main behavior is to steal Microsoft Office, .PDF, and .TIFF files from USB drives inserted into the system. These stolen files are stored in the $NtUninstallKB080515$ under the Windows folder. It also creates a log file named Usblog_DXM.log. The files can be retrieved by
New Apache backdoor serving Blackhole exploit kit

New Apache backdoor serving Blackhole exploit kit

Apr 27, 2013
A new sophisticated and stealthy Apache backdoor meant to drive traffic to malicious websites serving Blackhole exploit kit widely has been detected by  Sucuri recently. Researchers claimed that this backdoor affecting hundreds of web servers right now. Dubbed Linux/Cdorked.A , one of the most sophisticated Apache backdoors we have seen so far. The backdoor leaves no traces of compromised hosts on the hard drive other than its modified httpd binary, thereby complicating forensics analysis. All of the information related to the backdoor is stored in shared memory.  The configuration is pushed by the attacker through obfuscated HTTP requests that aren't logged in normal Apache logs. The HTTP server is equipped with a reverse connect backdoor that can be triggered via a special HTTP GET request. This means that no command and control information is stored anywhere on the system. ESET researchers  analyzed the binary and discovered a nasty hidden backdoor. In the Li
New Mac malware opens secure connection for a remote hacker

New Mac malware opens secure connection for a remote hacker

Feb 20, 2013
A new malware threat for the Mac has been discovered that attempting to set up a secure connection for a remote hacker to connect through and grab private information. Dubbed " Pintsized " that uses a modified version of OpenSSH to potentially set up a remote connection into Mac accounts. This backdoor Trojan can be used to conduct distributed denial of service (DDoS) attacks, or it can be used to install additional Trojans or other forms of malicious software. Since the connection between the hacker and the machine is encrypted, it becomes very hard for the Trojan to be detected or traced. The threat has the potential to become serious, as it uses an exploit in OS X to bypass Gatekeeper and establish a reverse shell that creates a secure connection.  Trojan stays hidden by disguising itself as a file that is used for networked printers in Mac OS X. The location of the malware has been traced to this particular directory. This tactic conceals the Trojan and makes a moni
Incapsula introduces 'Backdoor Protect' feature in Cloud-based Website Security

Incapsula introduces 'Backdoor Protect' feature in Cloud-based Website Security

Jan 30, 2013
Incapsula announced this week that they're offering an intriguing Backdoor Protection feature for sites using their cloud-based website security and performance services. What's a Backdoor? A backdoor is a malicious function that enables hackers to remotely operate a site or server, even after whatever exploit they used for initial access has been patched. Installing a backdoor is often the first thing a hacker will do after gaining access to your site - so if you've been hacked before, there's a good chance you've already got one. Hackers love backdoors because they provide easy return access to the site. Once installed, backdoors can used to distribute spam and malware, launch distributed denial of service (DDoS) attacks, or to help steal valuable data like credit card numbers. Recently, Incapsula reported how during the ongoing DDoS attacks against United States banks, a backdoor was used to turn a compromised site into a unwilling foot-soldier in the hackers Zombie Bo
Cybersecurity Resources