#1 Trusted Cybersecurity News Platform Followed by 4.50+ million
The Hacker News Logo
Subscribe – Get Latest News
Insider Risk Management

account hacking | Breaking Cybersecurity News | The Hacker News

Facebook Hacker received $33,500 reward for Remote code execution vulnerability

Facebook Hacker received $33,500 reward for Remote code execution vulnerability

Jan 23, 2014
Facebook has paid out its largest Bug Bounty ever of $33,500 to a Brazilian security researcher for discovering and reporting a critical Remote code execution vulnerability, which potentially allows the full control of a server. In September, ' Reginaldo Silva' found an XML External Entity Expansion vulnerability affecting the part of Drupal that handled OpenID, which allows attacker to read any files on the webserver. As a feature, Facebook allows users to access their accounts using OpenID in which it receives an XML document from 3rd service and parse it to verify that it is indeed the correct provider or not i.e. Receives at https://www.facebook.com/openid/receiver.php  In November 2013, while testing Facebook's ' Forgot your password ' functionality, he found that the OpenID process could be manipulated to execute any command on the Facebook server remotely and also allows to read arbitrary files on the webserver. In a Proof-of-Concept ,
Biggest American Bank 'JPMorgan Chase' hacked; 465,000 card users' data stolen

Biggest American Bank 'JPMorgan Chase' hacked; 465,000 card users' data stolen

Dec 05, 2013
JPMorgan Chase , one of the world's biggest Banks has recently announced that it was the victim of a cyber attack and warned round 465,000 of its holders of prepaid cash cards on the possible exposure of their personal information. In the Security Breach that took place on the bank's website www.ucard.chase.com  in July, around 465,000 accounts are compromised i.e. 2% of the overall 25 million UCard users. JPMorgan confirmed that there is no risk for holders of debit cards, credit cards or prepaid Liquid cards. They informed the law enforcement in September, and till now no information on how attackers have conducted the attack has been disclosed. The JPMorgan spokesman Michael Fusco declared that the investigation allowed the identification of victim accounts and the data stolen, the bank already notifying the cardholders of the incident. JPMorgan representative also remarked that hackers haven't stolen money from any user's account, due this reason the company is not i
US news agency GlobalPost's twitter and website hacked by Syrian Electronic Army

US news agency GlobalPost's twitter and website hacked by Syrian Electronic Army

Sep 30, 2013
In a series of high profile hacks, ' Syrian Electronic Army (SEA) ' just a few minutes before took control twitter account and website of ' GlobalPost ', a US based news agency. 'Syrian Electronic Army is an organized hacking group loyal to the Syrian President Bashar al-Assad and known for their high profile cyber attacks. The hacker posted two tweets from the victim's account, saying " Think twice before you publish untrusted information about Syrian Electronic Army " and " This time we hacked your website and your Twitter account, the next time you will start searching for new job :) " (as shown in the screenshot). GlobalPost's Deputy Social Media and News Desk Editor 'Kyle Kim' also tweeted that " We've been hacked ". At this point it is unclear that How group managed to access the website and twitter account. We are connecting to the hackers for further information, stay tuned to the page f
cyber security

Demonstrate Responsible AI: Get the ISO 42001 Compliance Checklist from Vanta

websiteVantaCompliance / Security Audit
ISO 42001 helps organizations demonstrate trustworthy AI practices in accordance with global standards. With Vanta, completing the requirements for ISO 42001 compliance can be done in a fraction of the time. Download the checklist to get started.
Defending Your Commits From Known CVEs With GitGuardian SCA And Git Hooks

Defending Your Commits From Known CVEs With GitGuardian SCA And Git Hooks

May 20, 2024Software Security / Vulnerability
All developers want to create secure and dependable software. They should feel proud to release their code with the full confidence they did not introduce any weaknesses or anti-patterns into their applications. Unfortunately, developers are not writing their own code for the most part these days. 96% of all software contains some open-source components, and open-source components make up between  70% and 90% of any given piece of modern software . Unfortunately for our security-minded developers, most modern vulnerabilities come from those software components.  As new vulnerabilities emerge and are publicly reported as  Common Vulnerabilities and Exposures  (CVEs), security teams have little choice but to ask the developer to refactor the code to include different versions of the dependencies. Nobody is happy in this situation, as it blocks new features and can be maddening to roll back component versions and hope that nothing breaks. Developers need a way to  quickly  determine if
Another Facebook hack exposes primary email address facebook users

Another Facebook hack exposes primary email address facebook users

Jul 21, 2013
Last week we explained a critical vulnerability in Facebook that discloses the primary email address of facebook user. Later the bug was patched by Facebook Security Team. Today another similar interesting Facebook hack disclosed by another bug hunter, Roy Castillo. On his blog he explained a new facebook hack method that allows anyone to grab primary emails addresses of billions of Facebook users easily. Facebook Provides a App Dashboard for creating and managing your Facebook apps, with a range of tools to help you configure, build and debug your Facebook apps. The flaw exists in App settings, where application admin can add developer's profile also, but if the user is not a verified user, a error messages on page will disclose his primary email address. Using following mentioned steps, one was able to grab email addresses of all facebook users: Collect profile links of all facebook users from Facebook People Directory i.e https://www.facebook.com/directo
Malicious Pinterest browser plugin stealing passwords and spreading spam

Malicious Pinterest browser plugin stealing passwords and spreading spam

Jul 11, 2013
Social networking sites are unfortunately now major interest to malicious cyber criminals, spreading malware and building botnet army to steal money direct from your keyboards. Janne Ahlberg, a security professional from Finland found and analysed an interesting piece of malicious code, offered as browser plugin, and infecting system to steal passwords from user's browser and also modifies the original Pinterest Pins links to spam with malicious links automatically. A diet spam on Pinterest redirecting users to a malicious site with domain name  pinteresf.org , plausible-looking domain name, like original Pinterest with similar appearance. On page load, it triggers a pop up message to all incoming visitors, offering to download " Pinterest Tool " as shown in screenshots " To continue, install our Pinterest Tool and enjoy more features of our site. " Janne's investigation claims that, this fake site offering a fake malware loaded browser plugin, harvesting passwords from us
Hacking Facebook Account with just a text message

Hacking Facebook Account with just a text message

Jun 27, 2013
Can you ever imagine that a single text message is enough to hack any Facebook account without user interaction or without using any other malicious stuff like Trojans, phishing , keylogger etc. ? Today we are going to explain you that how a UK based Security Researcher, " fin1te " is able to hack any Facebook account within a minute by doing one SMS. Because 90% of us are Facebook user too, so we know that there is an option of linking your mobile number with your account, which allows you to receive Facebook account updates via SMS directly to your mobile and also you can login into your account using that linked number rather than your email address or username. According to hacker , the loophole was in phone number linking process, or in technical terms, at file  /ajax/settings/mobile/confirm_phone.php This particular webpage works in background when user submit his phone number and verification code, sent by Facebook to mobile. That submission form h
Facebook Hacking, technique to Spoof the content of any Facebook App

Facebook Hacking, technique to Spoof the content of any Facebook App

May 16, 2013
There are many unpatched loopholes or flaws in Facebook website, that allow hackers to inject external links or images to a wall, hijacking any facebook account or bypassing your social privacy . Today we are going to report about another unfixed facebook app vulnerability that allow a hacker to spoof the content of any Facebook app  easily. Nir Goldshlager from Break Security today exposed another major flaw that allows hacker to wall post spoofed messages from trusted applications like Saavn, Candy Crush, Spotify, Pinterest, or really any other application on Facebook. In 2012 Facebook's method of publishing called stream.publish and the  Stream Publish Dialog looks like the following:  https://www.facebook.com/dialog/stream.publish?app_id=xxxx&redirect_uri=https://www.facebook.com/&action_links=&attachment=%7B%27media%27:%20[%7B%27type%27:%20%27flash%27,%27swfsrc%27:%27https://files.nirgoldshlager.com/goldshlager2.swf%27,%27imgsrc%27:%27https://w
Hacked Twitter account of The Associated Press posted bogus report of attack at White House

Hacked Twitter account of The Associated Press posted bogus report of attack at White House

Apr 23, 2013
The Associated Press Twitter account has been hacked,and posted a bogus post about explosions at the White House and Barack Obama is injured. Within a few minutes, Twitter suspended the account, and Julie Pace, the chief White House correspondent for The A.P., announced at a White House briefing that the account had been hacked. " The president is fine ," spokesman Jay Carney said. " I was just with him. " AP said later: " The @AP twitter account has been hacked. The tweet about an attack at the White House is false. " The Syrian Electronic Army claimed responsibility, tweeting out: " Ops! @AP get owned by Syrian Electronic Army! #SEA #Syria #ByeByeObama. " Last year, it took over Twitter and Facebook accounts of the Al Arabiya news channel to spread fake news of a coup and explosion in Qatar, which sides with the Syrian rebels. Shortly after the account was suspended, Mike Baker, a reporter for the news organization, posted a messa
Cybersecurity
Expert Insights
Cybersecurity Resources