Subscribe to our newsletters
Sign Up

The Hacker News — Cyber Security, Hacking, Technology News

Thursday, May 03, 2018 Mohit Kumar

twitter-password-hack

Twitter is urging all of its 330 million users to change their passwords after a software glitch unintentionally exposed its users' passwords by storing them in readable text on its internal computer system.

The social media network disclosed the issue in an official blog post and a series of tweets from Twitter Support.

According to Twitter CTO Parag Agrawal, Twitter hashes passwords using a popular function known as bcrypt, which replaces an actual password with a random set of numbers and letters and then stored it in its systems.

This allows the company to validate users' credentials without revealing their actual passwords, while also masking them in a way that not even Twitter employees can see them.
twitter-password-reset
However, a software bug resulted in passwords being written to an internal log before completing the hashing process—meaning that the passwords were left exposed on the company's internal system.

Parag said Twitter had found and resolved the problem itself, and an internal investigation had found no indication of breach or passwords being stolen or misused by insiders.

"We found this error ourselves, removed the passwords, and are implementing plans to prevent this bug from happening again," Parag said.

"We are very sorry this happened. We recognize and appreciate the trust you place in us, and are committed to earning that trust every day."

Still, the company urged all of its 363 Million users to consider changing their passwords to be on a safer side.

How to Reset Twitter Password


In order to change your password on Twitter, click on your Profile Picture icon given in the top-right corner, then go to Settings and Privacy → Password. Now, type your current password, and enter a new one, and try keeping it stronger.

For the Twitter app for iOS and Android, click on your Profile Picture icon in the top-left corner, and then go to Settings and Privacy → Account → Change Password ("Password" on Android), and create a new, stronger password.

You should also change the password on all other services where you have used the same password.

You are also advised to enable two-factor authentication service on Twitter, which adds an extra layer of security to your account and help prevent your account from being hijacked.

Tuesday, October 11, 2016 Mohit Kumar

location-social-media-monitoring-tool
Facebook, Instagram, Twitter, VK, Google's Picasa and Youtube were handing over user data access to a Chicago-based Startup — the developer of a social media monitoring tool — which then sold this data to law enforcement agencies for surveillance purposes, the ACLU disclosed Tuesday.

Government records obtained by the American Civil Liberties Union (ACLU) revealed that the big technology corporations gave "special access" to Geofeedia.

Geofeedia is a controversial social media monitoring tool that pulls social media feeds via APIs and other means of access and then makes it searchable and accessible to its clients, who can search by location or keyword to quickly find recently posted and publicly available contents.

The company has marketed its services to 500 law enforcement and public safety agencies as a tool to track racial protests in Ferguson, Missouri, involving the 2014 police shooting death of Mike Brown.

With the help of a public records request, the civil rights group found that Geofeedia had entered into agreements with Twitter, Facebook, and Instagram for their users' data, gaining a developer-level access to all three social networks that allowed them to review streams of user content in ways that regular users of the public cannot.

The Denver Police Department recently signed a $30,000 annual deal with Geofeedia.

Here's what the major tech giants offered Geofeedia:
  • Facebook allowed the company to use its "Topic Feed API" that let Geofeedia obtain a "ranked feed of public posts" centered around specific hashtags, places or events.
  • Instagram provided Geofeedia access to its API (Application Programming Interface) that is a feed of data from users' public Instagram posts, including their location.
  • Twitter provided Geofeedia with "searchable access" to its database of public tweets. However, Twitter added additional contract terms in February to try to safeguard further against surveillance, and when found Geofeedia still touting its product as a tool to monitor protests, Twitter sent Geofeedia a cease and desist letter.
Facebook, Instagram, and Twitter have all moved to restrict access to Geofeedia after learning about the tool's activities when presented with the study's findings.

The ACLU is concerned that Geofeedia can "disproportionately impact communities of color" by monitoring activists and their neighborhoods.

Nicole Ozer, technology, and civil liberties policy director for the ACLU of California said: "These special data deals were allowing the police to sneak in through a side door and use these powerful platforms to track protesters."

However, in response to the ACLU report, Geofeedia posted Tuesday an article justifying its commitment to Freedom of Speech and Civil Liberties, releasing the following statement:
"Geofeedia has in place clear policies and guidelines to prevent the inappropriate use of our software; these include protections related to free speech and ensuring that end-users do not seek to inappropriately identify individuals based on race, ethnicity, religious, sexual orientation or political beliefs, among other factors."
Facebook said in a statement that Geofeedia only had access to publically available data, while Twitter said it was suspending access shortly.

The ACLU is encouraging social media companies to adopt clear, public, and transparent policies prohibiting developers from exploiting user data for surveillance purposes.

Saturday, July 23, 2016 Mohit Kumar

download-twitter-vine-source-code
Guess What? Someone just downloaded Twitter’s Vine complete source code.

Vine is a short-form video sharing service where people can share 6-second-long looping video clips. Twitter acquired the service in October 2012.

Indian Bug bounty hunter Avinash discovered a loophole in Vine that allowed him to download a Docker image containing complete source code of Vine without any hassle.

Launched in June 2014, Docker is a new open-source container technology that makes it possible to get more apps running on the same old servers and also very easy to package and ship programs. Nowadays, companies are adopting Docker at a remarkable rate.

However, the Docker images used by the Vine, which was supposed to be private, but actually was available publically online.

While searching for the vulnerabilities in Vine, Avinash used Censys.io – an all new Hacker’s Search Engine similar to Shodan – that daily scans the whole Internet for all the vulnerable devices.

Using Censys, Avinash found over 80 docker images, but he specifically downloaded 'vinewww', due to the fact that the naming convention of this image resembles www folder, which is generally used for the website on a web server.

After the download was complete, he ran the docker image vinewww, and Bingo!
Hacker Downloaded Vine's Entire Source Code. Here’s How...
The bug hunter was able to see the entire source code of Vine, its API keys as well as third-party keys and secrets. "Even running the image without any parameter, was letting me host a replica of VINE locally," He wrote.

The 23-year-old reported this blunder and demonstrated full exploitation to Twitter on 31 March and the company rewarded him with $10,080 Bounty award and fixed the issue within 5 minutes.

Avinash has been an active bug bounty hunter since 2015 and until now has reported 19 vulnerabilities to Twitter.

Tuesday, September 29, 2015 Swati Khandelwal

snowden-twitter
Whistleblower Edward Snowden just joined Twitter, and his first tweet seems to be directed at the US National Security Agency (NSA).

Yes, the world's most popular whistleblower and data privacy advocate has finally joined Twitter just two hours ago, and his first tweet came, “Can you hear me now?”

Snowden has gained more than 260,000 followers in just less than two hours, but he is currently following only one account: @NSAGov, the official Twitter account for the National Security Agency.

Twitter has verified Snowden's Twitter account (@Snowden), and his Twitter bio provides a short summary of his prolonged situation.
Snowden's Twitter bio reads, "I used to work for the government. Now I work for the public. Director at @FreedomofPress."
Snowden is listed as director of Freedom of the Press, a foundation dedicated to ensuring transparency in journalism in adverse situations.

The former NSA contractor Edward Snowden sought asylum in Russia after publicly leaking a trove of classified documents belongs to the NSA exposing the extent of the US Government’s Global surveillance programs.

For this, the 32-year-old whistleblower is facing espionage and theft charges in the United States.

In his second tweet, Snowden responded to the astrophysicist Neil deGrasse Tyson, who welcomed him to Twitter.
He writes, "@neiltyson Thanks for the welcome. And now we've got water on Mars! Do you think they check passports at the border? Asking for a friend."

Friday, September 04, 2015 Khyati Jain

diffy-bug-hacker
After, Facebook open sourced Thrift Technology (an internally used tool by Facebook) in 2007, rival entity Twitter brings Diffy, an internal Twitter service to the world.

Yesterday, Twitter introduced "Diffy," an open source tool, acting as a helping hand for the software developers to catch bugs, test and compare results without writing much code.

Diffy plays a vital part in Twitter's development. As a service - Twitter modifies portions of its complex code on a timely basis, and Diffy is packed with such advanced automated techniques that it helps Twitter in its smooth workflow and optimized performance.

Diffy simultaneously relieves programmers from writing separate codes to test flaws in the modified code.

As, Diffy's minimal setup requirements are adaptable to any kind of environment. Apache Thrift and HTTP-based communication are such elaborate environments where Diffy catches bugs automatically.

But, What exactly Diffy is?


Diffy surely finds bugs, but by comparing instances of your new and old code side by side and acting as a proxy and multicasting requests it receives to each of the running instances, Diffy reports for any regressions gathered from these comparisons.
"The premise for Diffy is that if two implementations of the service return 'similar' responses for a sufficiently large and diverse set of requests, then [both the] implementations can be treated as equivalent, and the newer implementation is regression-free," said Puneet Khanduri, a member of Twitter's tools and frameworks team.
Diffy's highlighted feature is its modern noise cancelation technique, which is considered as a niche element when measured to other comparison based regression analysis tools.

You can avail Diffy's service @ Github, also take a glimpse of what Puneet Khanduri has to say in Twitter's official blog.

Thursday, August 27, 2015 Khyati Jain

Mark's Milestone: 1 Billion People Uses Facebook in A Single Day
Yesterday, Facebook Co-founder and Chairman Mark Zuckerberg broadcast in his Facebook post, that Monday Facebook made a record by counting ONE BILLION people accessing Facebook in a single day.

Zuckerberg shared his happiness and thanked the world. He was overwhelmed with the milestone Facebook has touched and even shared a video expressing his emotions.
"[Facebook] just passed an important milestone," Zuckerberg wrote in a Facebook post on Thursday. "For the first time ever, one billion people used Facebook in a single day."
That means roughly 1 in 7 people on Earth connected with their friends and family using Facebook in a single day.

Feeling Connected Indeed!


So far, Facebook is the world's largest online social networking website with 1.5 Billion monthly active users. Comparatively, Twitter has 316 Million monthly active users.

Zuckerberg felt proud of the Facebook community. As they are the ones, who helped him to reach such a position.

His post was then swarmed with his followers comments, which was a good read, as people from different places around the world shared their stories about how they met their long-lost friends and relatives, made new ones too!

Also, similar stories followed with people thanking and congratulating the man behind Facebook.

No lazy Monday this week @Facebook, Menlo Park, California.

Wednesday, November 26, 2014 Mohit Kumar

Twitter will now Track EVERY App You have Installed on Your Smartphone
Like Facebook and Google, Twitter will soon be collecting your smartphone data in order to provide a "more personal Twitter experience" by serving targeted advertisements.

The popular microblogging service Twitter said Wednesday that it will start collecting information about the other applications its users have installed onto their smartphones or tablet in a bid to better target ads and content, which some users may consider as another threat to their online privacy.
In the Security and Privacy section of its support site, Twitter says that it will be "collecting and occasionally updating the list of apps installed on your mobile device so we can deliver tailored content that you might be interested in."
The company has updated its app with this new feature for iOS platform on Wednesday, and Android will integrate this new feature in the next week.

The app update is opt-out, which means Twitter will start collecting information from users automatically unless they explicitly tell it otherwise. So, if you have already opted out of interest-based ads on iOS and Android, "we will not collect your apps unless you adjust your device settings," Twitter said.

The approach is simple, by tracking the apps people are downloading, Twitter is trying to learn more about its user base, so that it can suggest more relevant ads to users and make more money. The company says it will also improve its suggestions for accounts to follow and adding "Tweets, accounts, or other content to your timeline that we think you'll find especially interesting."

Twitter assured its users that it will only track applications users have installed, not any data from within the applications. As it said, "We are only collecting the list of applications you have installed. We are not collecting any data within the applications."

Still if you are not interested, You can turn off this feature through main Twitter app's settings menu. 
  • For iOS device users, disable this through setting -> account -> privacy -> "Tailor Twitter based on my apps."
  • For Android users, settings -> account -> other -> "Tailor Twitter based on my apps."
If you are getting any issue regarding this, you can also go to Twitter’s website which details exactly how to opt-out this feature for both Android and iOS.

For your knowledge, Twitter isn’t the only service to be tracking its users' apps. Facebook, for instance, also checks which apps users have installed that use the Facebook SDK to better surface targeted ads, though it also allows users to opt out.

Friday, October 24, 2014 Swati Khandelwal

There’s a good news for app developers. On Wednesday at Twitter’s first annual developer conference Flight, the company announced a new tool for developers which will allow users to log-in to mobile applications using their phone numbers rather than a traditional username and password combinations.

SAY NO TO PASSWORD
The service will be called Digits, aimed at application developers looking for an easier, password-free login option for their mobile applications – in a similar way to Snapchat, WhatsApp and Viber that rely only on verified users’ mobile numbers for sign-in, rather than the traditional ID and password combination.
"This is an entirely new native mobile sign up service that makes mobile-first sign-up frictionless, and creates an identity relationship entirely between you and your users," said Twitter CEO Dick Costolo, speaking at the Twitter Flight developer conference in San Francisco.

DEVELOPERS DON’T TRUST TWITTER
On one hand, where other social networking companies encouraged third-party developers to develop their own applications and services on top of the platform. Twitter always tried to reassert control over its product and platform and therefore being hated by developer community, but this new move will definitely solve this all.

According to the app developer Marco Arment, Twitter can’t be trusted again. "We’re just innocent bystanders getting hit whenever this fundamentally insecure, jealous, unstable company changes direction, which happens every few years," wrote Arment, who most recently developed Overcast, an app for listening to podcasts. "Twitter will never, and should never, have any credibility with developers again."

HOW DIGITS WORKS
Basically, Digits uses SMS messages to control access to registered accounts. When a developer adds Digits to its application, the user will be able to sign-in to that application using his or her mobile phone number.

Once the user provides the mobile phone number, Twitter will send a verification code on the provided mobile number via an SMS. User then enters that the SMS-based confirmation code to the log-in, and have access to the application. Note that each code Twitter sends you via SMS will expire after it's used. The process is just like a two-step verification one.


INTRODUCING FABRIC
Digits is one of many products announced at the developers conference in San Francisco. The company also introduced Fabric – a free software development kit for apps. Fabric will have three components:
  • MoPub – It is a mobile advertising platform bought by Twitter for $350m last year. It will help developers monetise their products on the Twitter platform.
  • Crashlytics – Crash reporting service, Crashlytics, bought by Twitter for $100m in 2013, will help developers test and build their apps as well as debug them.
  • TwitterKit – It enables apps to integrate into Twitter for streamlining real-time information. For example, the popular transport app Citymapper will now Tweet live updates from San Francisco’s Bart train system to users. TwitterKit allows developers to embed Tweets natively, as well as allows users to log into apps via Twitter.
"Fabric was built with ease of use in mind," Twitter's director of product, Jeff Seibert, wrote in a blog post. "Installation takes just minutes, and most features only require a few lines of code—so you spend less time managing SDKs and more time building the best experience for your users."
You can also go to the Digits website, which looks very basic at this time, in order to know more about it. Digits is launching now in 216 countries and 28 languages, which represents a serious move from Twitter’s end in terms of owning a piece of the mobile landscape.

Friday, May 09, 2014 Mohit Kumar

Reset Twitter Password With SMS and Monitor Suspicious Logins With Features
The popular social media site Twitter is rolling out a couple of new features to its login process to help users prevent their account in a more secure way and restore access to their account if they forget their accounts’ password.

For tighten up the security measures Twitter is launching two factor authentication in its new password reset experience, making its users to reset their password in easier way and at the same time difficult for cybercriminals to log in to users’ accounts.

"The new process lets you choose the email address or phone number associated with your account where you'd like us to send your reset information. That way, whether you've recently changed your phone number, or are traveling with limited access to your devices, or had an old email address connected to your Twitter account, you've got options," Twitter said in a blogpost on Thursday.

RESET TWITTER PASSWORD WITH SMS
This new experience will let Twitter users to enable password resets via phone SMS, only they will need to do is register their mobile number with their respective account. In case they've forgotten their password, they'll need to go to the standard 'Forgot password?' page and enter their mobile number or username.

Twitter will then text a six digit code that is valid only for 15 minutes, which the user has to enter on a web page before being prompted to choose a new password for their account. This SMS-based feature is the same that Google has enabled in its Gmail email service since 2009.
Reset Twitter Password With SMS and Monitor Suspicious Logins With Features
But, in case if users do not receive any code they are required to review SMS troubleshooting page or use the email password reset option.

SUSPICIOUS LOGIN NOTIFICATION
Along with the new password reset experience for its users, Twitter has also introduced enhanced user identification processes to identify the logins and blocking of suspicious logins in an effort to boost up account security.

Google also functions similar to identified suspicious login, for that it has a back-end behavioural analysis system for Gmail that identifies doubtful login attempts and also can flag account takeover attempts from state-sponsored attackers.

This new move is in the wake of users who reuse their same passwords for multiple sites, if one site is compromised by an attacker, the stolen passwords could be used to access users’ multiple sites accounts including Twitter.

So, to protect users account in this scenario, Twitter built a new system that analyzes login attempts to accounts by looking at information such as location, device used and login history and identifies suspicious behaviour.

“If we identify a login attempt as suspicious, we’ll ask you a simple question about your account – something that only you know – to verify that your account is secure before granting access,” Mollie Vandor, a product manager at Twitter wrote in a blog post. “We’ll also send you an email to let you know that we've detected unusual activity so you can update your password if need be.”

Twitter said it has also made it easier to reset a lost password on your iOS and Android devices and that it has also added some customized tips to help users strengthen account security in the future.

Sunday, March 23, 2014 Mohit Kumar

Learn How to access Twitter in Turkey | #TwitterisBlockedinTurkey
Twitter, the biggest Social Media platform used for vital communication is now banned in Turkey from the last few days, after Prime Minister Recep Tayyip Erdoğan promised to root out the social media service during an election rally this week with the help of a court order.
“Twitter and so on, we will root them out. The international community can say this or that – I don’t care. They will see the power of the Turkish Republic.”
After the ban imposed on Twitter late on Thursday, millions of Turkey users began using Google’s DNS service to bypassing censorship, that briefly helped Turks stay connected to Twitter.

Turkey Government is trying to close all the possible loopholes that had allowed users to circumvent the ban and finally today the authorities have also blocked the Google DNS service (8.8.8.8 and 8.8.4.4), However the number of tweets jumped 138% in the last 24 Hours and almost 2.5 million tweets have been posted from the country after the ban imposed.

Why Turkey Government Banned Twitter?
According to media reports, Earlier this month a voice recording of the prime minister was leaked on YouTube and Twitter, which include the audio of Prime Minister Recep Tayyip Erdoğan instructing his son to dispose of large amounts of cash in the midst of a police investigation.

Erdogan has dismissed most of the audio recordings as a vile montage put together by his political rivals. Twitter reportedly refused to delete incriminating audio of him. s;“Twitter has been used as a means to carry out systematic character assassinations by circulating illegally acquired recordings, fake and fabricated records of wiretapping,” the prime minister’s office of public diplomacy said in a statement.

Turkey has blocked access to YouTube in the past, but this is the first ban on Twitter, which is hugely popular in the country.

USE VPN OR Tor: Besides the Google DNS, people in Turkey have been using Open DNS, VPN and SMS services to get the word out. Twitter is still accessible for the tech savvy via Virtual Private Networks (VPN) or by the Tor Browser Bundle. [How to install and use Tor].

Use alternate DNS: Turkey users can use following alternate DNS servers to access Twitter:
Level31 209.244.0.3 209.244.0.4
Google2 8.8.8.8 8.8.4.4
Comodo Secure DNS 8.26.56.26 8.20.247.20
OpenDNS Home3 208.67.222.222 208.67.220.220
DNS Advantage 156.154.70.1 156.154.71.1
Norton ConnectSafe4 199.85.126.10 199.85.127.10
GreenTeamDNS5 81.218.119.11 209.88.198.133
SafeDNS6 195.46.39.39 195.46.39.40
OpenNIC7 216.87.84.211 23.90.4.6
Public-Root8 199.5.157.131 208.71.35.137
SmartViper 208.76.50.50 208.76.51.51
Dyn 216.146.35.35 216.146.36.36
censurfridns.dk9 89.233.43.71 89.104.194.142
Hurricane Electric10 74.82.42.42
puntCAT11 109.69.8.51
or use can use DNSCrypt: http://dnscrypt.org/

Access Twitter via SMS: Turkish users can also send Tweets using SMS. "Avea and Vodafone text START to 2444. Turkcell text START to 2555."

#TwitterisblockedinTurkey is trending globally as free-speech supporters around the world voiced their concerns. Some related tweets are shown below:
Learn How to access Twitter in Turkey | #TwitterisBlockedinTurkey
Learn How to access Twitter in Turkey | #TwitterisBlockedinTurkey
UPDATE:

TWITTER Hired LAWYER to fight Turkey Government
However, President Abdullah Gul is also in talks with Twitter to reach a speedy resolution to the block on the website in Turkey.

Twitter has taken action against the Turkish government’s blocking of access to it and hired a lawyer expert 'Gönenç Gürkaynak' in litigations related to Cyberlaw, who met with officials from Turkey’s Telecommunications Authority (TİB) in Ankara on behalf of Tweeter.
Learn How to access Twitter in Turkey | #TwitterisBlockedinTurkey
Union of Turkish Bar Associations (TBB) filed a petition in an Istanbul court for the lifting of the ban. “A total ban on Twitter access is a violation of the European Convention on Human Rights, the Turkish Constitution and Law 5651 that includes Internet regulations. The TTB has applied to the courts for the immediate lifting of the ban. In addition, criminal complaints have been filed for those responsible for the ban ruling and the officials who applied the ban,” TBB head Metin Feyzioğlu said in a statement.

SHARE AND SPREAD THE WORD!

Friday, March 14, 2014 Wang Wei

TWITTER is taking users' privacy and security very seriously and in an effort to prevent Government snooping, the company has secured your Twitter emails with with TLS (Transport Layer Security).

Twitter emails were previously using a plain text communication protocol, that now has been upgraded to an encrypted (TLS or SSL) connection using STARTTLS.

In a blog post, Twitter announced:
"Since mid-January, we have been protecting your emails from Twitter using TLS in the form of StartTLS. StartTLS encrypts emails as they transit between sender and receiver and is designed to prevent snooping. It also ensures that emails you receive from Twitter haven’t been read by other parties on the way to your inbox if your email provider supports TLS."
"These email security protocols are part of our commitment to continuous improvement in privacy protections and complement improvements like our securing of web traffic with forward secrecy and always-on HTTPS." said Josh Aberant, Postmaster at Twitter.

SSL/TLS and STARTTLS, both variants are equally secure, but the only difference is that: SSL/TLS is plain communication over an encrypted channel and STARTTLS is encrypted communication over a plain channel, which provides end-to-end encryption of emails and prevent from Man-in-the-middle attack, which is highly effective and quite difficult to detect.

TLS encryption only works if both the sender and receiver of emails support it and Twitter admire Gmail and AOL Mail, who are already supporting TSL encryption and encouraging other services to enable it, "Together, we can protect the privacy of every user." he said.

Wednesday, June 05, 2013 Mohit Kumar

Recently Twitter has rolled out Vine app for Android, A new way to share video on twitter. The free app, which enables people to record and share clips of up to six seconds with other Vine users as well as on Twitter and Facebook.

But on the very next day, Twitter’s video-sharing application Vine was hacked by 16-year-old Will Smidlein, who uploaded the three-and-a-half minute video of Rick Astley’s song “Never Gonna Give You Up.” This video violated Vine’s usual code that only six second videos are posted.

"I think I broke Vine," Will Smidlein tweeted Monday night , where he described himself as a Web developer.
What he did exactly? Smidlein decompile the app's code into a readable format, then modify few parts of the program that actually validate user to upload only 6 sec video.

"Sorry, Twitter/Vine engineers," he wrote. "I tried to keep it quiet, but the internet never forgets." , it could potentially embarrass a few of the engineers.

Just like the Vine app for iOS, the Android version also allows users to create videos easily with automatic playback and sound. The app also comes with an the Explore feature, which helps users in discovering popular posts and also get an idea of what is trending on Twitter.

After finishing the school year, the young teen will be working as an intern in San Francisco’s Pocket. Pocket is an application that allows for online content to be saved for access later for its users. Smidlein was even congratulated by Pocket for the crash.

Monday, April 22, 2013 Mohit Kumar

Trusteer researcher Tanya Shafir has recently identified an active configuration of TorRAT targeting Twitter users. Other than  spreading ideas on the most popular social networks, now cyber criminals are spreading malware.
The malware launches a Man-in-the-Browser (MitB) attack through the browser of infected PCs, gaining access to the victim’s Twitter account to create malicious tweets. 

Because the malware creates malicious tweets and sends them through a compromised account of a trusted person or organization being followed, the tweets seem to be genuine. Those tweets contain malicious links and they read : “Our new King William will earn even more than Beatrix. Check his salary” or “Beyonce falls during the Super Bowl concert, very funny!!!!”

At this time the attack is targeting the Dutch market. The malware spreading via the online social networking service, used as a financial malware to gain access to user credentials and target their financial transactions.


The attack is carried out by injecting Javascript code into the victim’s Twitter account page. The malware collects the user’s authentication token, which enables it to make authorized calls to Twitter's APIs, and then posts new, malicious tweets on behalf of the victim.

Because it uses a new sophisticated approach to spear-phishing, so attack is particularly difficult to defend. "This type of attack increases the need for enterprise exploit prevention technology: By blocking the exploitation of vulnerable endpoint user applications, like browsers, and preventing the malware download, exploit prevention technology stops the attack and prevents the malware from spreading and infecting more users," added the firm.

Friday, November 02, 2012 Mohit Kumar

Government eavesdropping and security agency GCHQ is developing new tools to sift through them for nuggets of useful data from Facebook, Twitter, LinkedIn, Google+, Pinterest. All of these are the source of valuable intelligence that the UK's intelligence agencies want to know about.

During a visit to Bletchley Park, UK foreign secretary William Hague launched a 'spy drive' to recruit staff for GCHQ and other intelligence agencies, a National Cipher Challenge for schools, and a £480,000 grant to the home of WW2 code-breaking.

“The work involves devising algorithms, testing them and general problem solving in the broad field of language and text processing. This pioneering research work is open to specialist in mathematical/statistics, computational linguists (eg speech recognition and/or language processing) and language engineering.” Job Description explains.
"Using data-mining techniques, you will help us to find meaningful patterns and relationships in large volumes of data. We are looking for skills across the following areas: data intensive computing ... graph mining (web search, social network analysis), data visualisation and statistical data analysis."

NSA already have such eavesdropping monitoring software, capable of sifting out information including watch-listed names, keywords and phrases from electronic communications flowing through America's networks

Ryan Gallagher from Guardian write, In 2009, GCHQ was revealed to have initiated a programme called Mastering the Internet, a £1bn project to help monitor online communications. But analysing massive volumes of data passing through Britain's networks has proven difficult for the intelligence agency due to advances in internet and mobile technology.

GCHQ, which employs more than 5,000 people, has had difficulty finding skilled new recruits as it has struggled to compete with salaries offered in the private sector.

Wednesday, October 17, 2012 Mohit Kumar

Official Twitter account of Rock band 'Garbage' has been compromised and hacker is posting Spam tweets and links using adf.ly, which is a url shortener service that pays on clicks. Hacked twitter account hack around 55,563 Followers.

Hacker can post malicious links also, but in this case we can see that purpose is not to infect other, instead hacker want to make some money by spreading links. Even he has mention this in a tweet, “All you people saying I'm dumb. I've made over 19 dollars by spamming ad.fly links. I hack twitters and spam them great money,”

How hacker got access to twitter account is not yet clear, may be phishing, social engineering or can be a  password guess, but once readers should learn the importance of strong password.

Yesterday we have posted another Exclusive report that, how 15000 wordpress blogs hacked and hacker is making money from referral system by posting spam articles on each blog.

Subscribe to our Daily Newsletter via email - Be First to know about Security and Hackers. or Join our Huge Hackers Community on Facebook, Google+ and Twitter.

Sunday, October 14, 2012 Mohit Kumar


A very quick and urgent warning for Twitter users, If you receive a direct message (DM) on Twitter saying "My profile was viewed..times..today" with a link then please don't click it. If you do, you will run the risk of having your Twitter account hijacked, your account turned into a spam-spewing tweet factory and all of your Twitter followers will be sent a personal copy of the same DM saying "My profile was viewed..times..today".

The direct message is a Scam aimed at stealing your twitter account. Or If any of this phishing scheme sounds familiar, it’s because this scam and others like it have been going around for quite some time now. Reason being, they’re all highly effective. Sure, the verbiage in the Twitter DMs may change periodically, but the goal of stealing your Twitter username and password stays the same.

We recommend you to:

  1. DO not click the link.
  2. DELETE that message
  3. ONCE REVIEW all the application you have allowed in your twitter profile, Here.
  4. REVOKE access of the suspicious applications immediate.


Subscribe to our Daily Newsletter via email - Be First to know about Security and Hackers. or Join our Huge Hackers Community on Facebook, Google+ and Twitter.

Newsletter Subscription

Subscribe to our newsletter and get all latest hacking news, free eBooks delivered to your inbox.

Join Over 450,000 Subscribers!