The Hacker News Logo
Subscribe to Newsletter

The Hacker News — Cyber Security and Hacking News Website: Google hacking

Google+ is Shutting Down After a Vulnerability Exposed 500,000 Users' Data

Google+ is Shutting Down After a Vulnerability Exposed 500,000 Users' Data

October 08, 2018Swati Khandelwal
Google is going to shut down its social media network Google+ after the company suffered a massive data breach that exposed the private data of hundreds of thousands of Google Plus users to third-party developers. According to the tech giant, a security vulnerability in one of Google+'s People APIs allowed third-party developers to access data for more than 500,000 users, including their usernames, email addresses, occupation, date of birth, profile photos, and gender-related information. Since Google+ servers do not keep API logs for more than two weeks, the company cannot confirm the number of users impacted by the vulnerability. However, Google assured its users that the company found no evidence that any developer was aware of this bug, or that the profile data was misused by any of the 438 developers that could have had access. "However, we ran a detailed analysis over the two weeks prior to patching the bug, and from that analysis, the Profiles of up to 500,00
Banking Trojan Gains Ability to Steal Facebook, Twitter and Gmail Accounts

Banking Trojan Gains Ability to Steal Facebook, Twitter and Gmail Accounts

November 17, 2017Swati Khandelwal
Security researchers have discovered a new, sophisticated form of malware based on the notorious Zeus banking Trojan that steals more than just bank account details. Dubbed Terdot, the banking Trojan has been around since mid-2016 and was initially designed to operate as a proxy to conduct man-in-the-middle (MitM) attacks, steal browsing information such as stored credit card information and login credentials and injecting HTML code into visited web pages. However, researchers at security firm Bitdefender have discovered that the banking Trojan has now been revamped with new espionage capabilities such as leveraging open-source tools for spoofing SSL certificates in order to gain access to social media and email accounts and even post on behalf of the infected user. Terdot banking trojan does this by using a highly customized man-in-the-middle (MITM) proxy that allows the malware to intercept any traffic on an infected computer. Besides this, the new variant of Terdot
Billion-Dollar Hacker Gang Now Using Google Services to Control Its Banking Malware

Billion-Dollar Hacker Gang Now Using Google Services to Control Its Banking Malware

January 20, 2017Mohit Kumar
Carbanak – One of the most successful cybercriminal gangs ever that's known for the theft of one billion dollars from over 100 banks across 30 countries back in 2015 – is back with a BANG! The Carbanak cyber gang has been found abusing various Google services to issue command and control (C&C) communications for monitoring and controlling the machines of unsuspecting malware victims. Forcepoint Security Labs researchers said Tuesday that while investigating an active exploit sent in phishing messages as an RTF attachment, they discovered that the Carbanak group has been hiding in plain site by using Google services for command and control. "The Carbanak actors continue to look for stealth techniques to evade detection," Forcepoint's senior security researcher Nicholas Griffin said in a blog post . "Using Google as an independent C&C channel is likely to be more successful than using newly created domains or domains with no reputation." Th
How to Make $100,000? Just Hack Google Chromebook

How to Make $100,000? Just Hack Google Chromebook

March 19, 2016Swati Khandelwal
Yes, you could earn $100,000 if you have the hacking skills and love to play with electronics and gadgets. Google has doubled its top bug bounty for hackers who can crack its Chromebook or Chromebox machine over the Web . So if you want to get a big fat check from Google, you must have the ability to hack a Chromebook remotely, that means your exploit must be delivered via a Web page. How to Earn $100,000 from Google The Chrome security team announced Monday that the top Prize for hacking Chromebook remotely has now been increased from $50,000 at $100,000 after nobody managed to successfully hack its Chromebook laptops last year. The Top bug bounty will be payable to the first person – the one who executes a ' persistent compromise ' of the Chromebook while the machine is in Guest Mode . In other words, the hacker must be able to compromise the Chromebook when the machine is in a locked-down state to ensure its user privacy.  Moreover, the hack
Google rewarded the Guy who Accidentally bought Google.com, But he Donated it to Charity

Google rewarded the Guy who Accidentally bought Google.com, But he Donated it to Charity

October 10, 2015Swati Khandelwal
Sanmay Ved – the man who actually managed to buy Google.com got a huge reward from Google, but he donated all money to charity. Last week, an ex-Google employee and now-Amazon employee managed to buy the world's most-visited domain Google.com via Google's own Domains service for only $12 . However, Ved owned Google.com for one whole minute before the Mountain View company realized it was a mistake and cancelled the transaction. After acknowledging the mistake, Google rewarded Ved with some unknown amount of cash, but when Ved generously suggested donating his prize money to charity instead, Google just doubled the reward. Google Rewarded Ved with More than $10,000 Ved believed that his real reward was just being the person who bought Google.com for a whole minute. "I do not care about the money," Ved told in an interview with Business Insider. "It was never about the money. I also want to set an example that [there are] people who [wi
How Amazon Employee bought 'Google.com' Domain for Only $12 from Google

How Amazon Employee bought 'Google.com' Domain for Only $12 from Google

October 01, 2015Swati Khandelwal
Difficult to believe this, as we hardly come across such news. But trust me, a person managed to buy no ordinary .com domain, but — Google.com and that too for one whole minute. Sanmay Ved , an ex-Google employee and current-Amazon employee, experienced something of a shock when he found that the world's largest search engine website, Google.com , was " available " for purchase. What's Even More Shocking? It's the cost of the most-trafficked domain in the world — Only $12 . Expecting to get an error message, Ved added the domain to his shopping cart and made payment. The entire purchasing process went through without any difficulty. Within moments, his inbox and Google Webmaster Tools were flooded with webmaster related messages confirming his ownership for Google.com . "The scary part was I had access to the webmaster controls for a minute," Ved said. However, soon he received an order cancellation email and refund fro
Microsoft issues Emergency Windows Update to Block Fake SSL Certificates

Microsoft issues Emergency Windows Update to Block Fake SSL Certificates

July 11, 2014Mohit Kumar
Today, Microsoft has issued an emergency update for almost all versions of Windows and also for Microsoft devices running Windows Phone 8 and 8.1 to secure users from attacks that abuse the latest issued rogue SSL certificates, which could be used to impersonate Google and Yahoo! websites. A week after the search engine giant Google spotted and blocked unauthorized digital certificates for a number of its domains that could result in a potentially serious security and privacy threat, Microsoft has responded back to block the bogus certificates from being used on its software as well. " Today, we are updating the Certificate Trust List (CTL) for all supported releases of Microsoft Windows to remove the trust of mis-issued third-party digital certificates, " said Dustin Childs, group manager of response communications. The fake digital certificates , issued by the National Informatics Centre (NIC) of India - a unit of India’s Ministry of Communications and Infor
Google catches Indian Government Agency with Fake Digital Certificates

Google catches Indian Government Agency with Fake Digital Certificates

July 09, 2014Swati Khandelwal
Google has identified and blocked unauthorized digital certificates for a number of its domains issued by the National Informatics Centre (NIC) of India, a unit of India’s Ministry of Communications and Information Technology. National Informatics Center (NIC) holds several intermediate Certification Authority (CA) certs trusted by the Indian government’s top CA, Indian Controller of Certifying Authorities (India CCA), which are included in the Microsoft Root Store and so are trusted by a large number of applications running on Windows, including Internet Explorer and Chrome. The use of rogue digital certificates could result in a potentially serious security and privacy threat that could allow an attacker to spy on an encrypted communication between a user’s device and a secure HTTPS website, which is thought to be secure. Google became aware of the fake certificates last Wednesday on July 2 and within 24 hours, the Indian Controller of Certifying Authorities (Ind
Nasty Covert Redirect Vulnerability found in OAuth and OpenID

Nasty Covert Redirect Vulnerability found in OAuth and OpenID

May 03, 2014Swati Khandelwal
After Heartbleed bug , a security flaw in widely used open-source software OpenSSL that puts countless websites at risk, another vulnerability has been found in popular authentication software OpenID and authorization software OAuth. Wang Jing , a Chinese mathematics Ph.D student at the Nanyang Technological University in Singapore, found that the OAuth and OpenID open source login tools are vulnerable to the " Covert Redirect " exploit. The login tools ‘ OAuth ’ and ‘OpenID’ protocols are the commonly used open standard for authorization. OAuth designed as a way for users to sign in or sign up for other services using an existing identity of a site such as Google, Facebook, Microsoft or Twitter, whereas OpenID is a decentralized authentication system for the Internet that allows users to log in at websites across the internet with same digital identity. The Covert Redirect vulnerability could affect those who use ‘OAuth’ and ‘OpenID’ protocols to ‘login’ to the websites
Researchers Get $10,000 for Hacking Google Server with Malicious XML

Researchers Get $10,000 for Hacking Google Server with Malicious XML

April 12, 2014Anonymous
A critical vulnerability has been uncovered in Google that could allow an attacker to access the internal files of Google’s production servers. Sounds ridiculous but has been proven by the security researchers from Detectify. The vulnerability resides in the Toolbar Button Gallery ( as shown ). The team of researchers found a loophole after they noticed that Google Toolbar Button Gallery allows users to customize their toolbars with new buttons. So, for the developers, it is easy to create their own buttons by uploading XML files containing metadata for styling and other such properties. This feature of Google search engine is vulnerable to  XML External Entity (XXE) . It is an XML injection that allows an attacker to force a badly configured XML parser to " include " or " load " unwanted functionality that can compromise the security of a web application. “ The root cause of XXE vulnerabilities is naive XML parsers that blindly interpret the DTD of t
Back off, NSA! Gmail now Encrypts every single Email

Back off, NSA! Gmail now Encrypts every single Email

March 21, 2014Wang Wei
2014 - The Year for Encryption! Good News for Security & Privacy seekers, Gmail is now more secure than ever before. Google has announced that it has enhanced encryption for its Gmail email service to protect users from government cyber-spying; by removing the option to turn off HTTPS . So from today, Gmail will always use an encrypted HTTPS connection by default when you check or send email. Furthermore, Google also assured that every single email message will now be encrypted as it moves internally between the company's data centers. " Today's change means that no one can listen in on your messages as they go back and forth between you and Gmail’s servers—no matter if you're using public WiFi or logging in from your computer, phone or tablet. " Nicolas Lidzborski, Gmail Security Engineering Lead said in a blog post . It was previously disclosed by Edward Snowden that the National Security Agency (NSA) is intercepting email messages as they
Ultrasonic Password Security for Google Accounts

Ultrasonic Password Security for Google Accounts

February 18, 2014Anonymous
Does a Strong Password Guarantee you the Security of your Online Account? If yes, then you should once check out our ' Data breaches ' section on the website. A Startup Company,  SlickLogin  has developed a technology that enables you to login into online accounts using Ultrasonic sound, instead of entering username and password on your. The company claims its technology offers " military-grade security " that replaces passwords in the two-step process simply by placing your Phone next to their laptop or tablet. When you sign-in via SlickLogin enabled website, the computer will play a sound which is encrypted into Ultrasonic Sound, inaudible to the human ear, but your Smartphone can hear it. The Smartphone Sends data back to the SlickLogin Servers for authentication and grants immediate access. Each sound is different, unique and cannot be reused to hack an account. Recently, Google has acquired this two month old Israeli Startup, " Today
Google adds its Chrome apps and extensions to Bug Bounty Program

Google adds its Chrome apps and extensions to Bug Bounty Program

February 06, 2014Anonymous
Google's Vulnerability Reward Program which started in November 2010, offers a hefty reward to the one who find a good vulnerability in its products.  Now Google is getting a little more serious about the security of its Chrome Browser and has expanded its Bug Bounty Program to include all Chrome apps, extensions developed and branded as " by Google ". The Internet is a platform which has become a necessary medium for performing our daily tasks like reading news, paying bills, playing games, scheduling meetings and everything we perform on this platform is possible only because of the various applications maintained by the service providers. " We think developing Chrome extensions securely is relatively easy, but given that extensions like Hangouts and GMail are widely used, we want to make sure efforts to keep them secure are rewarded accordingly. " Google said in a blog post . Not only this, to improve the security of open-source proje
Android based Cars may pose various Security and Privacy Issues

Android based Cars may pose various Security and Privacy Issues

January 07, 2014Swati Khandelwal
After being an owner of Smartphones, now it’s your turn to own a Smart Car. Wouldn’t it sound great if you could use your favorite mobile apps on Car's dashboard display? Yes! You heard right.. Google has tied-up with several Auto manufacturers with the goal to bring Android to Cars with built-in controls and hardware by the end of this year. Google has announced at the CES technology trade show in Las Vegas, the Open Automotive Alliance (OAA) will achieve this with their partners i.e. General Motors, Honda, Audi, Hyundai and chipmaker Nvidia. This new project is designed to accelerate innovation in the Automotive sector, with the customized version of most popular mobile platform 'Android' for Cars, that will bring Google Places, Maps, Voice, Earth and developer support to cars. " This open development model and common platform will allow automakers to more easily bring cutting-edge technology to their drivers, and create new opportunities for developers to delive
France Government used Rogue Google SSL Digital Certificates to Spy on users

France Government used Rogue Google SSL Digital Certificates to Spy on users

December 11, 2013Swati Khandelwal
Google has found that the French government agency using unauthorized digital certificates  for some of its own domains to perform man-in-the-middle attacks on a private network. Google security engineer Adam Langley described the incident as a "S erious Security breach ", which was discovered in early December. Rogue digital certificates that had been issued by French certificate authority ANSSI, who closely work with the French Defense agency. “In response, we updated Chrome’s certificate revocation metadata immediately to block that intermediate CA, and then alerted ANSSI and other browser vendors. Our actions addressed the immediate problem for our users” Google has immediately blocked the misused intermediate certificate and updated Chrome’s certificate revocation list to block all dodgy certificates issued by the French authority. In a statement, ANSSI said that the intermediate CA certificate was used to inspect encrypted traffic with the user's knowledge on a p
Can we Trust Google ? Company Speeding up Strong Encryption Program in response to NSA surveillance

Can we Trust Google ? Company Speeding up Strong Encryption Program in response to NSA surveillance

September 07, 2013Mohit Kumar
Trust is something that’s earned, not given. We trusted tech companies with our data because they promised to keep it secure. That trust was called into question after former NSA contractor Edward Snowden revealed that NSA is snooping on us with the help of same tech companies. Today Google announced that they have accelerated their efforts towards encrypting the information that has been flowing through its data centers across the world to thwart snooping by NSA and intelligence agencies, but do can you Trust Google and Other Internet Companies now ? " It's an arms race ," Eric Grosse, Google's vice president for security engineering, tells WP . " We see these government agencies as among the most skilled players in this game. " Google officials declined to provide details on the cost of its new encryption efforts, the numbers of data centers involved, or the exact technology used. According to the report, encrypted information would
Chinese hackers who breached Google in 2010 gained access to thousands of surveillance orders

Chinese hackers who breached Google in 2010 gained access to thousands of surveillance orders

May 21, 2013Mohit Kumar
In 2010, as part of what has been dubbed as Operation Aurora , Chinese hackers infiltrated a special database within Google’s systems and gained access to a sensitive database worth of information about American surveillance targets.  Google reported the hack publicly years ago, saying that the sophisticated attack resulted in the theft of Google intellectual property and the partial compromise of some human rights activists' email accounts. When the news first surfaced in 2010, Google said hackers stole the source code behind its search engine, and targeted email accounts of activists critical of China's human rights record. But recently discovered that the hackers also obtained surveillance information, including emails belonging to suspected spies, diplomats and terrorists which law enforcement officials had been monitoring. Google reported this breach to the FBI, resulting in a national security investigation. According to the sources, hackers were after the names of
Google, Paypal, Facebook Internal IP disclosure vulnerability

Google, Paypal, Facebook Internal IP disclosure vulnerability

December 31, 2012Anonymous
Do you have any idea about an Internal IP Address or a Private IP Address that too assigned for Multinational Companies? Yeah, today we are gonna discuss about Internal IP or Private IP address Disclosure. Disclosure of an Internal IP like 192.168.*.* or 172.16.*.* , can really Impact ? Most security researchers call it as "bull shit" vulnerability. But when it comes to impact calculation even if the server is behind a firewall or NAT, an attacker can see internal IP of the remote host and this may be used to further attacks. Internet Giants like Facebook, Google, PayPal and Serious National Security organizations like FBI, Pentagon and NASA are taking initiatives for their Security Issues. At same, we at ' The Hacker News ' stand together for organizations that talk about national security in a serious way. I guess,its the time to understand about the flaws and its impacts where I would like to share my findings about our Internet Giants and Organiza
Exclusive Deals

Get Daily News Updates By Email

Join over 350,000 information security professionals — Get the best of our cyber security coverage delivered to your inbox every morning.