Subscribe to our newsletters
Sign Up

The Hacker News — Cyber Security, Hacking, Technology News

Friday, January 02, 2015 Mohit Kumar

Hacker Released 'iDict' Tool That Can Hack Your iCloud Account
Hackers have a great start of new year 2015, giving a public threat to Apple’s online iCloud service. A hacker using the handle "Pr0x13" has released a password-hacking tool to GitHub website that assures attackers to break into any iCloud account, potentially giving them free access to victims’ iOS devices.

The tool, dubbed iDict, actually makes use of an exploit in Apple's iCloud security infrastructure to bypass restrictions and two-factor authentication security that prevents brute force attacks and keeps most hackers away from gaining access to users’ iCloud accounts.

Yes, the brute force security flaw in Apple’s iCloud file storage service that was responsible for celebrity nude photos leak, including Kim Kardashian, Vanessa Hudgens, Jennifer Lawrence, Rihanna, Kristin Dunst and Kate Upton, late last year.

Pr0x13 claims iDict to be a "100 percent" effective and simple to use method of cracking individual iCloud account login credentials. So, those using easy-to-guess passwords on their iCloud account are in more danger than those using a complex chain.

Despite countless warnings and advices in the past, online users are continuously using a weak strength of password chains such as "password," "12345678," "qwerty," "abc123," and "iloveyou", expecting that they couldn’t be a target of hack. But, now they need to worry about it.

iDict, currently hosted at GitHub, is limited by the size of the dictionary the tool uses to guess the password. At the time, the dictionary file only contains 500-word-long list of passwords. This means whilst it will succeed "100%" at trying 500 times over, the tool is by no means guaranteed to succeed at cracking your password. So if you are the one from the given 500-word-long list, your iCloud account is really at risk.

There is quite a low chance that this attack will actually work, but the attack would become an issue if someone with large set of resources gets access to the source code. A hacker with a much larger list of passwords might be able to compromise more accounts, however, we hope that Apple will patch this issue before this happens.

So far, we haven’t heard about any fallout from the release of the exploit, but users on Twitter and online discussion forum Reddit are saying that iDict is working as intended.

Pr0x13 says his intentions were only to alert Apple about the vulnerability, so that the company could fix the problem as soon as possible. The tool , according to the hacker, has been released to force Apple to act on the issue and nothing else. The company needs to fix the "painfully obvious" vulnerability before it's "privately used for malicious or nefarious activities," Pr0x13 explains on GitHub.

Apple needs to act fast on the issue to avoid another controversy like the celebrities' nude photo scandal of 2014, in which the brute force attack gave hackers access to countless personal and nude photographs of a number of high-profile celebs.

But, you just can’t rely fully on the company regarding your online security. As a precaution, first make sure that your password does not appear in Pr0x13’s password file and if it is change it immediately. Also change your password if you use a weak password! Moreover, enable two-factor authentication on all your accounts, if you haven't already.

Wednesday, November 05, 2014 Swati Khandelwal

BlackEnergy Cyber Crimeware equipped to Target Linux Systems and Cisco Routers
Security researchers at Kaspersky Lab have unearthed new capabilities in the BlackEnergy Crimeware weapon that has now ability to hacking routers, Linux systems and Windows, targeting industry through Cisco network devices.

The antivirus vendor’s Global Research & Analysis Team released a report Monday detailing some of the new “relatively unknown” custom plug-in capabilities that the cyber espionage group has developed for BlackEnergy to attack Cisco networking devices and target ARM and MIPS platforms.

The malware was upgraded with custom plugins including Ciscoapi.tcl which targets The Borg's kit, and According to researchers, the upgraded version contained various wrappers over Cisco EXEC-commands and "a punchy message for Kaspersky," which reads, "F*uck U, Kaspersky!!! U never get a fresh B1ack En3rgy. So, thanks C1sco 1td for built-in backd00rs & 0-days."

BlackEnergy malware program was originally created and used by cybercriminals to launch Distributed Denial-of-Service (DDoS) attacks. The malware developer then added some custom plugins used to funnel banking information.

Most recently BlackEnergy malware was observed in alleged state-sponsored attacks targeting the North Atlantic Treaty Organization (NATO), Ukrainian and Polish government agencies, and a variety of sensitive European industries over the last year.

Now, the cyber espionage group has enhanced the malware program which also has the capabilities like port scanning, password stealing, system information gathering, digital certificate theft, remote desktop connectivity and even hard disk wiping and destroying.

In case if a victim knew of the BlackEnergy infection on their system, the attacker activates "dstr," the name of a plugin that destroys hard disks by overwriting them with random data. A second victim was compromised by using VPN credentials taken from the first victim.

Security researchers, Kurt Baumgartner and Maria Garnaeva, also came across BlackEnergy version that works on ARM and MIPS based systems and found that it has compromised networking devices manufactured by Cisco Systems.

However, the experts are not sure for the purpose of some plugins, including one that gathers device instance IDs and other information on connected USB drives and another that collects details on the BIOS (Basic Input/Output System), motherboard, and processor of infected systems.
"We are pretty sure that our list of [BlackEnergy] tools is not complete," the researchers wrote. "For example, we have yet to obtain the router access plugin, but we are confident that it exists. Evidence also supports the hypothesis that there is a decryption plugin for victim files."
Multiple unnamed victim companies in different countries were targeted with the latest BlackEnergy malware, including victims in Russia, Germany, Belgium, Turkey, Libya, Vietnam and several other countries.

Another Crimeware group, the Sandworm Team, believed to have used the BlackEnergy exclusively throughout 2014 at victim sites and included custom plugin and scripts of their own. Also last month, the Sandworm Team had targeted organizations across the world in an espionage campaign, and iSIGHT Partners revealed that the team used spear phishing as the major attack vector to victimize their targets.

Saturday, October 04, 2014 Swati Khandelwal

BadUSB Malware Code Released — Turn USB Drives Into Undetectable CyberWeapons
Once again USB has come up as a major threat to a vast number of users who use USB drives – including USB sticks and keyboards. Security researchers have released a bunch of hacking tools that can be used to convert USB drive into silent malware installer.

This vulnerability has come about to be known as "BadUSB", whose source code has been published by the researchers on the open source code hosting website Github, demanding manufacturers either to beef up protections for USB flash drive firmware and fix the problem or leave hundreds of millions of users vulnerable to the attack.

The code released by researchers Adam Caudill and Brandon Wilson has capability to spread itself by hiding in the firmware meant to control the ways in which USB devices connect to computers. The hack utilizes the security flaw in the USB that allows an attacker to insert malicious code into their firmware.

But Wait! What this means is that this critical vulnerability is now available online for hackers, cyber criminals and everybody to use so as to infect as many computers as they want.

SOURCE CODE AVAILABLE ONLINE TO EVERYBODY
In a talk at the Derbycon Hacker Conference in Louisville last week, the duo were able to reverse engineer the USB firmware, infect it with their own code, and essentially hijack the associated device. The researchers also underlined the danger of the Bad USB hack by going in-depth of the code.

The security hole was first revealed by researchers from Berlin-based Security Research Labs (SRLabs in Germany) at the Black Hat security conference in Las Vegas two months ago, and here you can watch the video of their presentation. The German researchers didn’t publish their source code because they thought it to be dangerous and too hard to patch.
“We really hope that releasing this will push device manufactures to insist on signed firmware updates, and that Phison will add support for signed updates to all of the controllers it sells,” Caudill said in a blog post. “Phison isn’t the only player here, though they are the most common—I’d love to see them take the lead in improving security for these devices.”
THE GOOD NEWS AND THE BAD
The good news is that this vulnerability presents in only one USB manufacturer Phison electronics, a Taiwanese electronics company. But the bad side of it is that Phison USB sticks can infect any given device they are plugged into, and the company has not yet revealed who it manufactures USB sticks for. This is the fact it is still unclear as to how widespread the problem may be at the moment.

A Phison USB stick can infect any type of computer, but it isn’t clear if its able to infect any other USB device that is plugged into them afterwards or not. However, Phison controllers are found in a very large number of USB thumb drives available on the market.

BadUSB VULNERABILITY IS UNPATCHABLE
The flaw in USB basically modifies the firmware of USB devices, which can easily be done from inside the operating system, and hides the malware in USB devices in a way that it become almost impossible to detect it. The flaw goes worst when complete formatting or deleting the contents of a USB device wouldn't vanish the malicious code, since its embedded in the firmware.

According to Wired, the vulnerability is "practically unpatchable" because it exploits "the very way that USB is designed." Once infected, each USB device will infect anything it's connected to, or any new USB stick coming into it.

IMPACT OF BadUSB ATTACK
Once compromised, the USB devices can reportedly:
  • enter keystrokes
  • alter files
  • affect Internet activity
  • infect other systems, as well, and then spread to additional USB devices
  • spoofs a network card and change the computer’s DNS setting to redirect traffic
  • emulates a keyboard and issue commands on behalf of the logged-in user, for example to exfiltrate files or install malware
During their Derbycon demonstration, the two researchers replicated the emulated keyboard attack, but also showed how to create a hidden partition on thumb drives to defeat forensic tools and how to bypass the password for protected partitions on some USB drives that provide such a feature.

MANUFACTURER DENIES THE PROBLEM
Security researchers tried to contact Phison electronics, the manufacturer of the vulnerable USB devices, but the company "repeatedly denied that the attack was possible."

Friday, October 03, 2014 Wang Wei

Windows 10 Preview Has A Keylogger With Your Own Permission
This week Microsoft announced the next version of its Operating system, dubbed WIndows 10, providing Windows 10 Technical Preview release under its "Insider Program" in order to collect feedback from users and help shape the final version of the operating system, but something really went WRONG!
“Inside Microsoft’s Insider Program you'll get all the latest Windows preview builds as soon as they're available. In return, we want to know what you think. You’ll get an easy-to-use app to give us your feedback, which will help guide us along the way.” Microsoft website reads.
Well, how many of you actually read the “Terms of Service” and “Privacy Policy” documents before downloading the Preview release of Windows 10? I guess none of you, because most computer users have habit of ignoring that lengthy paragraphs and simply click "I Agree" and then "next", which is not at all a good practise.

Also Read: Deep Web Search Engines.

Do you really know what permissions you have granted to Microsoft by installing Free Windows 10 Technical Preview edition? Of Course, YOU DON’T. Well, guess what, you've all but signed away your soul !!

PERMISSION TO KEYLOG
If you are unaware of Microsoft’s privacy policy, so now you should pay attention to what the policy says. Microsoft is watching your every move on the latest Windows 10 Technical Preview, Thanks to portions of Microsoft's privacy policy, which indicates that the technology giant is using keylogger to collect and use users’ data in a variety of astounding ways without the user being aware.
“If you open a file, we may collect information about the file, the application used to open the file, and how long it takes any use [of] it for purposes such as improving performance, or [if you] enter text, we may collect typed characters, we may collect typed characters and use them for purposes such as improving autocomplete and spell check features,” the privacy policy states.
Essentially by accepting the Windows 10 privacy policy you are allowing Microsoft to screen your files and log your keystrokes. This means, if you open a file and type, Microsoft have access to what you type, and the file info within.

Also Read: Top Best Password Managers.

This could likely one of the reasons why the company insisted that Windows Technical Preview not be installed on computers that are used every day.

OTHER DATA COLLECTION
But Wait! Wait! Not just this, Microsoft says it may collect even more data. The company will be watching your apps for compatibility, and collect voice information when you use speech to text. This information will be used to improve speech processing, according to Microsoft.
"When you acquire, install and use the Program, Microsoft collects information about you, your devices, applications and networks, and your use of those devices, applications and networks," the privacy policy states. "Examples of data we collect include your name, email address, preferences and interests; browsing, search and file history; phone call and SMS data; device configuration and sensor data; and application usage."
Though, technology companies continue to develop a fine line on the issue of privacy and data collection and based on the information which the Microsoft collects, it could have thousands of username and password combinations stored in a database somewhere. But we may well see a public feedback to this newest attempt to mine users data.

However, it is clearly known that they are not going to use those data to access users’ bank accounts or company's private network, but the fact that the company is collecting data by all means, could possibly open a way for someone to steal and misuse the information for their own purpose.

Although the feedback being collected in the Windows Technical Preview will only occur within the Technical Preview period, reported by WinBeta. Once Windows 10 launches to the public as RTM, the data Microsoft collects will be removed from the operating system.

If you wish to test it out, you can Download Windows 10 Preview Edition Here.

Sunday, September 28, 2014 Wang Wei

Privacy-focused Tails 1.1.2 Operating System Released
Tails, a Linux-based highly secure Operating System specially designed and optimized to preserve users' anonymity and privacy, has launched its new release, Tails version 1.1.2.

Tails, also known as 'Amnesiac Incognito Live System', is a free security-focused Debian-based Linux distribution, which has a suite of applications that can be installed on a USB stick, an SD card or a DVD. It keeps users’ communications private by running all connectivity through Tor, the network that routes traffic through various layers of servers and encrypts data.

The operating system came into limelight when the global surveillance whistleblower Edward Snowden said that he had used it in order to remain Anonymous and keep his communications hidden from the law enforcement authorities.

The new version 1.1.2 addresses a single but critical vulnerability which arises because the Network Security Services (NSS) libraries parser used by Firefox and other browsers is capable of being tricked into accepting forged RSA certificate signatures.
"We prepared this release mainly to fix a serious flaw in the Network Security Services (NSS) library used by Firefox and other products allows attackers to create forged RSA certificates," reads the Tails official website.
"Before this release, users on a compromised network could be directed to sites using a fraudulent certificate and mistake them for legitimate sites. This could deceive them into revealing personal information such as usernames and passwords. It may also deceive users into downloading malware if they believe it's coming from a trusted site."
Cyber criminals may use Man-in-the-middle (MitM) attacks by impersonating as a bank or webmail provider and tricking online users into handing over their login credentials that can be then passed on to the legitimate organisation.

Tails 1.1.2 comes with the following security updates:
  • Updated TOR version (based on Firefox 24.8.0 ESR+tails3~bpo70+1)
  • New Linux kernel has been added, 3.16-1
  • Numerous other software upgrades that fix security issues in GnuPG, APT, DBus, Bash, and packages built from the bind9 and libav source packages
Mozilla Firefox also released a quick security patches for its Firefox versions and Thunderbird, as its open source browser is vulnerable to SSL man-in-the-middle attacks due to RSA certificate forgery. The patches are already available.

Firefox ESR 31.1.1, Firefox ESR 24.8.1, Thunderbird 31.1.1, and Thunderbird 24.8.1 have been updated to NSS 3.16.2.1. Also Firefox 32.0.3 and SeaMonkey 2.29.1 have been updated to NSS 3.16.5.

Users can download Tails 1.1.2 latest release from Tails official website.

Wednesday, September 24, 2014 Mohit Kumar

Kali Linux "NetHunter" — Turn Your Nexus Device into Hacking Weapons
The developers of one of the most advance open source operating system for penetration testing, 'KALI Linux' have announced yesterday the release of a new Kali project, known as NetHunter, that runs on a Google Nexus device.

Kali Linux is an open source Debian-based operating system for penetration testing and forensics, which is maintained and funded by Offensive Security, a provider of world-class information security training and penetration testing services. It comes wrapped with a collection of penetration testing and network monitoring tools used for testing of software privacy and security.

After making its influence in hacker and security circles, Kali Linux has now been published with Kali Nethunter, a version of the security suite for Android devices. The tool is a mobile distribution designed to compromise systems via USB when installed and run on an Android phone.

Kali Linux NetHunter project provides much of the power to Nexus users, those running the NetHunter penetration testing platform can now launch attacks including Teensy keyboard via HID style attacks and BadUSB man-in-the-middle (MITM) networking attacks via USB human interface device (HID), wireless 802.11 frame injection, and could setup evil access points in a single click.
“Our NetHunter images support programmable HID keyboard attacks, (a-la-teensy), as well as “BadUSB” network attacks, allowing an attacker to easily MITM an unsuspecting target by simply connecting their device to a computer USB port,” the Offensive Security team said. “In addition to these built in features, we’ve got a whole set of native Kali Linux tools available for use, many of which are configurable through a simple web interface.”
Nethunter is currently available for Nexus devices only, but builds for other Android devices are likely on the way. Nethunter contained a full Kali Linux toolset, including support for self destruction, software defined radio and the ability to launch a Kali desktop VNC session on Nexus phone.

The tools are designed for use by an attacker who has physical access to a device — an insider threat — or someone who gains access through social engineering, tailing etc.
Kali Linux "NetHunter" — Turn Your Android Device into Hacking Weapons
On one hand, Teensy Keyboard attacks on PCs can be used to automatically elevate privileges on a Windows PC and install a reverse-HTTP tunnel to a remote workstation. On the other hand, BadUSB can force a Windows PC to recognize the USB-connected phone as a network adapter and re-route all the traffic of the PC through it for monitoring purposes.

Additionally, the Kali NetHunter configuration interface helps users to easily manage complex configuration files through a local web interface, which together with 802.11 wireless injection and a pre-configured connect VPN service make it a “formidable network security tool or discrete drop box – with Kali Linux at the tip of your fingers wherever you are.”

Kali NetHunter open source security platform supports Nexus 10 and 7 tablets and Nexus 5 phones built on the existing Kali (formerly Backtrack) Linux platform. The official Kali NetHunter images can be downloaded from the Offensive Security NetHunter download page.

Wednesday, May 28, 2014 Swati Khandelwal

Latest Kali Linux 1.0.7 Offers Persistent Encrypted Partition on USB Stick
There is a good news for all Security researchers, Penetration testers and Hackers. The developers of one of the most advance open source operating system for penetration testing, 'KALI Linux' have announced yesterday the release of its latest version of Kali Linux 1.0.7 with some interesting features.

Kali Linux is an open source Debian-based distribution for penetration testing and forensics that is maintained and funded by Offensive Security, a provider of world-class information security training and penetration testing services.

In the beginning of this year, Offensive Security released Kali Linux 1.0.6 with Kernel version 3.12, and also added the Self Destruct feature that allows Kali users to encrypt the full hard disk to make the data inaccessible in an emergency case by entering a secret password at boot time.

This latest Kali Linux 1.0.7 version added some more features to the last version, along with many new penetration testing and hacking tools. The new release includes the most stable and latest kernel i.e. Linux kernel 3.14 with bug fixes, performance improvement and hardware support.

KALI LIVE USB PERSISTENCE ENCRYPTION
The most attractive feature added to the latest Kali Linux release is ‘Live USB persistence encryption’, which allows you to create a bootable Kali Linux with persistent encrypted partition on USB drive, that gives you an option to securely save your changes on the USB drive even after the reboots.

Kali Linux now offers two persistent options in the boot menu, as shown. One is an encrypted USB persistence partition and other one is unencrypted persistence partition.
Latest Kali Linux 1.0.7 Offers Persistent Encrypted Partition on USB Stick
This was one of the most awaiting feature that now allows penetration testers and hackers to keep their data, customized scripts and favorite 3rd party hacking tools organized in the Live Kali Linux on bootable USB Sticks.

UPGRADE KALI LINUX NOW!
If you are already have Kali Installed onto your system, then there is no need to download and reinstall the latest updated version from scratch. Instead, you can use following commands to upgrade to Kali 1.0.7 easily:
apt-get update
apt-get dist-upgrade
# If you've just updated your kernel, then:
reboot
The new release also includes ARM image scripts, and team has promised to provide some additional virtual machine images and custom ARM images in the near future.

Monday, May 19, 2014 Swati Khandelwal

FBI Arrests 100 Hackers linked to Blackshades Malware
On Friday, we reported about the large-scale operation of International raids launched by the FBI and other law enforcement officials in countries around the world to arrest the targeted customers of a popular Remote Administration Tool (RAT) called ‘Blackshades,’ which is designed to take over the remote control of the infected computers and steal information.

The news broke when various announcements on underground forums by hacking group members claimed that FBI especially going after all of them who purchased the hacking tool using PayPal as payment option.

Today, the UK's National Crime Agency announced that the raids took place in more than 100 of countries and they have arrested more than 100 people worldwide involved in the purchasing, selling or using the Blackshades malware.

More than half million computers in more than dozens of countries were infected by this sophisticated malware that has been sold on underground forums since at least 2010 to several thousands people, which cost between 40 and 100 dollars.

The Investigation involved the law enforcement coordination agencies Europol and Eurojust said Monday that authorities raided a total of 359 houses in 13 different European countries, including Austria, Belgium, Britain, Croatia, Denmark, Estonia, Finland, France, Germany, Italy, Moldova, the Netherlands and Switzerland, as well as in the United States, Canada and Chile, and seized cash, firearms, drugs and over 1,100 data storage devices including computers, laptops, mobile phones, routers etc.

“This case is a strong reminder that no one is safe while using the internet, and should serve as a warning and deterrent to those involved in the manufacture and use of this software,” said Koen Hermans, an official representing the Netherlands in the European Union's criminal investigation coordination unit, Eurojust. “This applies not only to victims, but also to the perpetrators of criminal and malicious acts. The number of countries involved in this operation has shown the inherent value in Eurojust’s coordination meetings and coordination centres.”

As we reported in previous article, the Blackshades website (http://bshades.eu/) has now been seized by the FBI. 

‘Blackshades’ is a remote administration tool (RAT) and is sold legally around the world but bad intention actors are using the tool as a malware for collecting private information of innocent users, including usernames and passwords for email and Web services, instant messaging applications, FTP clients and lots more.

In worst cases, the malicious program even allows hackers to take remote control of users’ computer and webcam to take photos or videos without the knowledge of the computer owner.

The infected PCs can also be hijacked by the attackers to perform DDoS attacks and other illegal activities without any knowledge of its owner. The program modifies itself in such a way so that it remains elusive for antivirus software.

In 2012, while a very serious and bloody internal war between the government and the opposition forces, the BlackShades RAT was also used to infect and Spy on Syrian activists. However, in 2012, a developer of the Blackshades team was reportedly arrested and during same time the source code of the tool was also leaked on the Internet.

BlackShades tool was actually developed by an IT surveillance and security-based company, who promoted it as a tool for parents to monitor their Children activities and for finding the cheating partners in relationship. But, as usual every weapon could be used for both purposes, killing and saving lives.

Friday, May 16, 2014 Wang Wei

FBI raids BlackShades RAT Malware Customers in Europe
When it comes to crime, whether it’s an online or offline, FBI doesn't spare anyone. According to the French media reports and various announcements on underground forums by hacking groups, the FBI has started a large-scale operation of International raids with the help of local law enforcement authorities to arrest a particular group of cyber criminals and Hackers.

The FBI has targeted the customers of a popular Remote Administration Tool (RAT) called ‘blackshades’, which allows them to connect and manage thousands of remotely infected computers over the Internet.

WHAT IS BLACKSHADES RAT??
‘Blackshades’ is a remote administration tool (RAT) which allows an attacker to control several clients from around the world. 

Blackshades malware  is fully equipped with Drive-by attacks, Java exploits, keylogger and it allows an attacker to steal usernames and passwords for email and Web services, instant messaging applications, FTP clients and lots more.

In worst cases, the program even allows hackers to take remote control of users’ computer and webcam to take photos or videos without the knowledge of the computer owner.

The infected PCs can also be used to perform DDoS attacks and other illegal activities without any knowledge of its owner. The program modifies itself in such a way so that it remains elusive for antivirus software. It has been sold on underground forums since at least 2010, which cost between 40 and 100 dollars.
FBI raids BlackShades RAT Malware Customers in Europe
In 2012, while a very serious and bloody internal war between the government and the opposition forces, the BlackShades RAT was also used to infect and Spy on Syrian activists.

However, Back in 2012, a developer of the Blackshades team was reportedly arrested and during same time the source code of the tool was also leaked on the Internet.

FBI RAID AND SEIZURE
On various hacking forums, members claimed that FBI especially going after all of them who purchased the hacking tool using PayPal as payment option, so it could be estimated that PayPal is cooperating with the FBI.

Some claimed, even if the FBI has no record or evidence that those customers committed any crime or not, they are still raiding in search of logs and proofs.

Few users of ‘Blackshades’ Tool posted on the Hack Forums website that their houses are being raided by the FBI.

A user from Germany reported that he was visited by German police on purchased of the BlackShades RAT and agents seized his PC, laptop, external hard drive, and cryptography-related documents.

Another user from the Netherlands posted on the Hack Forums that he too has been visited by seven agents of the country’s cyber crime police, who seized his phone, computer and other electronics as well.

The current ongoing FBI raid-campaign is targeting only European, including Belgium, UK, Denmark, Italy, Sweden and even the Australian Customers, but till now we have not seen any evidence of raids in the US or Canada.

FBI has also seized the European domain of BlackShades official website (www.eurid.eu) and modified the owner details to 'Federal Bureau of Investigation', as shown.
FBI raids BlackShades RAT Malware Customers in Europe
Marjinz, a member of BlackShades developer team claimed on a forum that FBI got their customer database from his Hotmail, but he even didn't know HOW! It could be possible that Microsoft has provided the content from developer's Hotmail account to the FBI.

 FBI WARNING TO HACKERS
This could be in response to the latest Wednesday announcement of the FBI that it is planning searches and multiple arrests of cyber criminals over the next several weeks for combating cybercrime, Reuters reported.

"There is a philosophy change. If you are going to attack Americans, we are going to hold you accountable," the FBI's Robert Anderson told the Reuters. "If we can reach out and touch you, we are going to reach out and touch you."

BlackShades tool was actually developed by an IT surveillance and security-based company, who promoted it as a tool for parents to monitor their Children activities and for finding the cheating partners in relationship. But, as usual every weapon could be used for both purposes, killing and saving lives.

Update: One of our reader from Canada confirmed that his house was also raided by 'Royal Canadian Mounted Police' (FBI of Canada) two days ago. 'My son bought Blackshades and they had a warrant and search the entire house. They confiscated his computer.' he said.

Thursday, April 03, 2014 Sudhir K Bansal

LinkedIn Hack Tool Exposes Users' Emails without Exploiting Any Vulnerability
A Free Chrome, Firefox and Safari web browser plugin floating around the web, called 'Sell Hack' allows users to view the hidden email address of any LinkedIn user, means anyone can grab email addresses that we use for professional purposes.

When installed, the 'Sell Hack' plugin will pop up a 'Hack In' button on LinkedIn profiles and further automatically mines email addresses of LinkedIn users.

NOT A SECURITY BREACH
It's not a Security breach, LinkedIn has confirmed that no LinkedIn data has been compromised, but rather this free extension rely on an algorithm that checks publicly available data in order to guess users’ email addresses.

So without exploiting any loophole or vulnerability, Sell Hack is capable of predicting users' email addresses with OSINT (Open-Source Intelligence) techniques i.e. information collected from publicly available sources.

It is also possible that, the Sell Hack extension is gathering data from users who have installed it, allows plugin to watch your activity on the site and collect the information of any direct connection whose page you've decided to visit; so this way Sell Hack can cross-serve the collected data to other users.

LinkedIn users who have downloaded Sell Hack should uninstall it immediately, "LinkedIn members who downloaded Sell Hack should uninstall it immediately and contact Sell Hack requesting that their data be deleted." LinkedIn officials warned.

LINKEDIN IS NOT HAPPY
The Professional Social Network giant LinkedIn has decided to take legal action and publicly criticised Sell Hack in statements. LinkedIn pulled SellHack Team to the door of judiciary for disclosing the email IDs of users to the un-connected users.

"We are doing everything we can to shut Sell Hack down. On 31 March LinkedIn's legal team delivered Sell Hack a cease-and-desist letter as a result of several violations," a LinkedIn spokesman said.

IS IT LEGAL?
The Developers Sell Hack tool explained, “The data we process is all publicly available. We just do the heavy lifting and complicated computing to save you time. We aren't doing anything malicious to a Social website. We think browser extensions are the best way to personalize an individual's web experience.”

On their website, Sell Hack answered, How does it work? "If we don't received a validation response, we'll present a 'copy all' button to copy & paste the list for your own uses: i.e. check your own data sources or BCC email the entire list etc." that Means, if service will not be able to guess the user's email address, it will ask you to enter your emails database for further match-search.

SOLUTION
Two days back LinkedIn has sent a cease-and-desist notice to Sell Hack for violating the LinkedIn Terms of Service and as a result the SellHack extension is no more working on the LinkedIn pages. "SellHack plugin no longer works on LinkedIn pages," developers stated.

Monday, March 03, 2014 Swati Khandelwal

Cisco Offers $300,000 Prize For 'Internet of Things' Security Apps
In the last few years, this emerging domain for the Internet of Things has been attracting the significant interest, and will continue for the years to come. It would be a $20 Trillion Market over the next several years, but Security and privacy are the key issues for such applications, and still face some enormous challenges.

Cisco has announced a global and industry-wide initiative to bring the Security community and Researchers together to contribute in securing the Internet of Things (IoT) and launched a contest called the "Internet of Things Grand Security Challenge", offering prizes of up to $300,000 for winners.

Since Smart devices are growing at an exponential pace with increase in connecting devices embedded in cars, retail systems, refrigerators, televisions and countless other things people use in everyday life and is expected to grow to 50 billion by 2020. So, in an effort to deliver the security solutions necessary to protect the increasing range of connected devices in the Internet of Things, Cisco has challenged security experts around the world.

"We're connecting more of our world every day through smart, IP-enabled devices ranging from home appliances, healthcare devices, and industrial equipment. These new connected devices are offering new ways to share information and are changing the way we live," reads the blog post.

The Contest was announced by the senior vice president of the security group at Cisco, Christopher Young, in his keynote at this week's RSA Conference, said "the idea is 'a contest of experts around the world to submit blueprints' for how security issues created by the Internet of Things could be addressed. It's expected that up to six winning entries would be selected and the prize money awarded at the Internet of Things Forum in the fall."

It's expected that up to six winning entries would be selected and the prize money from $50,000 to $75,000 would be awarded by Cisco to winning contestants at the Internet of Things Forum in the fall.

A Cisco team of security experts will evaluate proposals based on the following criteria:

  • Feasibility, scalability, performance, and ease-of-use
  • Applicability to address multiple IoT verticals (manufacturing, mass transportation, healthcare, oil and gas, smart grid, etc.)
  • Technical maturity/viability of the proposed approach
  • Proposers’ expertise and ability to feasibly create a successful outcome
About a month back, we already posted that how hundreds of thousands of Smart TVs, Refrigerator, and other smart household appliances were compromised by hackers to send out malicious spam emails.

So, in future the "Internet of Things" can become an easy weapon for cyber criminals to launch large scale of cyber attacks and to protect ourselves, we should have a good and effective security solution, in which Cisco is contributing a way.

The winners of the Internet of Things Security Grand Challenge will be named in the northern autumn of 2014, by The Evaluation Panel of Cisco.

Wednesday, February 26, 2014 Swati Khandelwal

Tilon/SpyEye2 infections declined after SpyeEye author's Arrest
Today, when we come across various malware, exploit kits and botnets that are in the wild, we think about an effective Antivirus solution or a Security Patch, but the most effective solution is always "The arrest of malware authors and culprits who are involved in the development of Malware."

Tilon has been an active malware family that was spotted first time in 2012, was specially designed to filch money from online bank accounts, that earlier various researchers found to be the new version of Silon, is none other than the SpyEye2 banking Trojan, according to researchers at security firm Delft Fox-IT.

Tilon a.k.a SpyEye2 is the sophisticated version of SpyEye Trojan. Majority functional part of the malware is same as of the SpyEye banking Trojan that was developed by a 24-year-old Russian hacker 'Aleksandr Andreevich Panin' or also known as Gribodemon, who was arrested in July 2013.

‘SpyEye’, infected more than 1.4 million Computers worldwide since 2009, designed to steal people’s identities and financial information, including online banking credentials, credit card information, user names, passwords and PINs. It secretly infects the victim’s computer and gives the remote control to the cybercriminals who remotely access the infected computer through command and control servers and steal victims’ personal and financial information through a variety of techniques, including web injects, keystroke loggers, and credit card grabbers without authorization.
Tilon/SpyEye2 infections declined after SpyeEye author's Arrest
Researchers have confirmed that, the team who had developed the SpyEye is the same who created Tilon, and that is why it was labeled as SpyEye2.
“The team behind its creation was similar, however, reinforced with at least one better skilled programmer,” said the researchers, adding, “The management of SpyEye2 is done through a single, unified interface, which has been completely redesigned but still contains a few of the unique features of the original SpyEye.”
An interesting part of SpyEye2, which the researchers found ‘slightly funny’, is that the malware check for the removal of the older version of SpyEye installed in the infected system and replace it with the new version, i.e. SpyEye2 with better stability features.

“No other malware families are checked for removal. Early versions of the original SpyEye were likewise equipped with a feature to remove older versions of ZeuS installed on the infected system,” researchers say.
According to the researchers, “only the Loader portion of Tilon is sourced from Silon, but this is where the similarity ends. As shown above and further illustrated in the Appendices, the body (i.e., functional portion) of Tilon was actually based on SpyEye.”
Also, another reason to consider Tilon as SpyEye's variant is its success, which was in the wild from 2012 to 2014, and suddenly seems to be over as the SpyEye author arrested last year.

Fox-IT researchers say, “the arrests, like Gribodemon and other key figures in the underground economy, such as Paunch, the author of the popular Blackhole Exploit Kit, is the key to decreasing the worldwide activity around online crime.”

It doesn’t mean that the malware won’t circulate its fraudulent activity in the future, but will finally come to an end after nearly a year of declining usage.

Tuesday, February 25, 2014 Swati Khandelwal

Apple's SSL Vulnerability may allowed NSA to hack iOS Devices Remotely
Just two days before Apple has disclosed a critical Security flaw in the SSL implementation on the iOS software that would allow man-in-the-middle attacks to intercept the SSL data by spoofing SSL servers.

Dubbed as CVE-2014-1266, the so-called ‘goto fail;’ vulnerability in which the secure transport failed to validate the authenticity of the connection has left millions of Apple users vulnerable to Hackers and Spy Agencies, especially like the NSA.

Last Friday, Apple had also released updated version iOS 7.0.6 to patch the vulnerability, which was first discovered in Apple's iOS Devices, but later company had acknowledged its presence in Mac OSX also, that could allow hackers to intercept email and other communications that are meant to be encrypted in iPhone, iPad and Mac computer. Affected versions include iOS up to version 7.0.5 and OS X before 10.9.2.

Security Researchers confirmed, 'Nearly all encrypted traffic, including usernames, passwords, and even Apple app updates can be captured.' with man-in-the-middle attack.

Apple Vulnerability and NSA
I am sure; you still remember the NSA's DROPOUTJEEP Hacking Tool, implant for Apple iOS devices that allows the NSA to remotely control and monitor nearly all the features of an iPhone, including text messages, Geo-Location, microphone and the Camera.
Dropoutjeep iphone hacking tool
DROPOUTJEEP program was developed in 2008 to conduct espionage on iPhone users, which was revealed by the documents provided by Edward Snowden a month ago. "The initial release of DROPOUTJEEP will focus on installing the implant via close access methods." document reads.

According to the vulnerability details published by a Google's Security Researcher 'Adam Langley', a basic mistake in a line of the SSL Encryption code almost screwed up the iOS SSL certificate verification process with an open invitation for the NSA's Prying Eyes.

"This sort of subtle bug deep in the code is a nightmare," Adam Langley said on his blog, "I believe that it's just a mistake, and I feel very bad for whoever might have slipped in an editor and created it."
iOS SSL Encryption code
Security researchers, Jacob Applebaum said last December, "Either the NSA has a huge collection of exploits that work against Apple products, meaning that they are hoarding information about critical systems that American companies produce and sabotaging them, or Apple sabotaged it themselves."

Although, those old techniques are no longer in circulation, but the NSA has a track record of continually evading the privacy of users by exploiting vulnerabilities in various softwares and obviously NSA's capabilities have improved significantly in the past five years. 

In the DROPOUTJEEP document, the NSA also admitted, 'A remote installation capability will be pursued for a future release.' That means, it's practically possible that the NSA had already discovered this iOS SSL flaw in an effort to hack iPhone users' remotely by sniffing data and spoofing them to install malware.

An Unanswered Question
'Was the Apple intentionally injected backdoors for NSA or the flaw was an accident???' If it was an accident, then Apple would have been able to release patches for both iOS and Mac OS X at the same time, instead of releasing the patches for both, it silently released a fix for iOS devices on Friday night, but when the cryptographers and security experts began criticizing the company for leaving OS X without the patch, they finally acknowledged Mac OS X too; But it's the 4th day after disclosure and no patch yet  has been released for Mac OS X.

Also, Apple contacted CVE (Common Vulnerabilities and Errors database) on 8th January 2014 to reserve the bug number CVE 2014-1266 for the SSL vulnerability and later they have released updated iOS 7.1, which was also vulnerable to the flaw that Apple had already discovered.

However, Apple categorically denied working with the NSA on a backdoor after it was accused last December of creating a way for the US intelligence agency NSA to access contacts and other data in iPhones. 

On Dec. 31, Apple spokesperson released a statement saying:
"Apple has never worked with the NSA to create a backdoor in any of our products, including iPhone. Additionally, we have been unaware of this alleged NSA program targeting our products. Whenever we hear about attempts to undermine Apple's industry-leading security, we thoroughly investigate and take appropriate steps to protect our customers. We will continue to use our resources to stay ahead of malicious hackers and defend our customers from security attacks, regardless of who’s behind them."
In 2013, The US Department of Defense passed Apple's iOS 6 for the Government use, that means if the NSA was aware of this flaw, they didn't seem to have informed them.

To Check, whether your web browser is vulnerable to SSL flaw, Click here and to be safe, you are recommended to use an alternate web browser, rather than Safari web browser and avoid using public and unsecured networks.

UPDATE: Apple has finally today releases Mac OS X 10.9.2, which includes a fix for a major SSL security flaw and bringing with it a number of "improvements to the stability, compatibility and security of your Mac."

Monday, February 24, 2014 Swati Khandelwal

Hacking Team sold Spyware to 21 Countries; Targeting Journalists and Human Right Activists
Spying on the world by injecting sophisticated backdoors in software, systems, and mobile phones, leads to violation of the Privacy and Security of every individual. Yes, we are talking about Surveillance, but this time not about NSA.

Instead, Countries including some with poor human-rights records and a much less technically advanced nation are the likely culprits, as they apparently used commercial spyware in making surveillance capabilities that once were the exclusive expertise of the known spy agencies, such as National Security Agency (NSA) and GCHQ.

Citizen lab, a nonprofit research lab has found traces of a remote hacking tool in 21 countries, developed by Hacking Team, including Ethiopia, Sudan, Azerbaijan and Saudi Arabia, which the team had already denied back in 2013.

Hacking Team, also known as HT S.r.l, is an Italian company, which is known for its powerful surveillance software, Remote Code System (RCS) that it sells to Governments and law enforcement agencies.

Senior Counsel of Hacking Team, Eric Rabe stated that the company does not provide its products to 'repressive regimes.'
"On the issue of repressive regimes, Hacking Team goes to great lengths to assure that our software is not sold to governments that are blacklisted by the EU, the US, NATO, and similar international organizations or any “repressive regime."
Remote Control System (RCS) is a malware, can be defined as 'instrument of crime', infects computers and Smartphones in order to enable covert surveillance. The company claims that its Trojan once installed in the victims’ computer, can intercept encrypted communication, including emails and Skype voice calls. Furthermore, RCS can turn on a device’s webcam and microphone to spy on the user without their knowledge.

The Team prominently advertises that their RCS spyware is "untraceable" to a specific government operator and can be installed remotely. They say that it can scale up to monitor "hundreds of thousands of targets" and is capable of being deployed to Apple, Android, Symbian, and Blackberry mobile devices.
"Hacking Team has made a number of statements that seem intended to reassure the public, as well as potential regulators, that they conduct effective due diligence and self-regulation regarding their clients, and the human rights impact of their products," the Citizen Lab researchers report on Monday. "They also market their RCS product as untraceable. Our research suggests that both of these claims ring hollow." 

The researchers at Citizen Lab have found traces of Remote Control System (RCS) by mapping the spyware's network of proxy servers, which the Hacking Team claims that RCS is "untraceable."
"Our research reveals that the RCS collection infrastructure uses a proxy-chaining technique, roughly analogous to that used by general-purpose anonymity solutions like Tor, in that multiple hops are used to anonymize the destination of information," reads the report. "Despite this technique, we are still able to map out many of these chains and their endpoints using a specialized analysis." Citizen Lab researchers explained.

On the basis of tracing endpoints of Hacking Team proxy chains, the researchers suspected that the agencies of 21 Governments are current or former Clients of RCS, and the country names are Azerbaijan, Colombia, Egypt, Ethiopia, Hungary, Kazakhstan, Korea, Malaysia, Mexico, Morocco, Nigeria, Oman, Panama, Poland, Saudi Arabia, Sudan, Thailand, Turkey, UAE, Uzbekistan, including Italy which is the homeland of the Hacking Team.

The Governments are targeting for political advantage, including the US-based news Organization, rather than using it for legitimate law enforcement operations.

According to researchers at Citizen Lab, The No.1 suspect is Ethiopian Government, that used the hacking tool created by Hacking Team to carry out the spying operation against the Ethiopian journalists in the United States and Europe.


Hacking Team to Citizen Lab:
“We have established an outside panel of technical experts and legal advisors, unique in our industry that reviews potential sales. This panel reports directly to the board of directors regarding proposed sales.”
However The FBI, which investigates Computer crimes, declined to comment on the Citizen Lab report, but an activist at the Electronic Frontier Foundation (EFF) and an expert in surveillance technology, Eva Galperin said that:
"If the Ethiopian government is not a Hacking Team customer, then I would sure like to know how their tools wound up being used to spy on Ethiopian journalists."

Friday, December 13, 2013 Mohit Kumar

LOCKER Malware Yet another new variant of Cryptolocker Ransomware
Ransomware, a threat to internet users that continues to grow in popularity with cyber criminals due to its success and monetary potential. This is nothing new and to be expected. I have noticed many discussions on underground hacking forums about "How to create Ransomware like Cryptolocker malware" or "Malware - hacking tool-kit with ransomware features".
Security intelligence provider, IntelCrawler has discovered  a new ransomware variant called Locker that demands $150 (£92) to restore files that it has encrypted.

Like Cryptolocker, this new ransomware is also nasty because infected users are in danger of losing their personal files forever.

Locker mainly spreads by drive-by downloads from compromised websites, disguised itself as MP3 files and use system software vulnerabilities to infect the end user.

Once it has infected a system, malware first checks the infected machine has an internet connection or not. Then it deletes any original files from the victim's computer after using AES-CTR for encrypting the files on infected devices and add ". perfect" extension to them.

Locker's encryption is based on an open source tool called 'TurboPower LockBox' library. After encrypting all files, the malware place a "CONTACT.TXT" file in each directory, which provides contact details of the author to buy the decryption key and once the ransom is paid, each victim gets a key to unscramble files.

The good news is that the researchers are working on the universal decryption software in order to help the victims. "It appears that the hackers are simply comparing the list of infected IP addresses of users, along with their host names," according IntelCrawler.

IntelCrawler had discovered 50 different builds of the malware, which are being sold in underground markets for pay-per install programs. One builds had just under 6,000 infected machines. ZdNet reported.

Malware will encrypt all drives visible on an infected system, so you must be sure that your backups are stored remotely or in a location that is not simply another drive partition or mapping to another location.

The malware infects users from the United States, Turkey, Russia, Germany and the Netherlands. Users should remain vigilant about their security. Please double check the legitimacy of links received in emails and ensure you have your antivirus up to date to help protect against such threats.

Wednesday, December 11, 2013 Mohit Kumar

Eric Rosol, A  38-year-old hacker who joined an Anonymous hacker attack for just one minute has been sentenced to two years of federal probation and ordered to pay $183,000 fine.
Yes you read right! $183,000 fine  for just 1 Minute of DDoS attack.
In 2011, Eric participated in a distributed denial-of-service (DDoS) attack organized by hacker collective Anonymous against the servers of Koch Industries.

The DDoS attack was organized in opposition to Koch Industries’ reported weakening of trade unions.

He used a software called a Low Orbit Ion Cannon Code, LOIC is a popular DDoS tool used by anonymous hackers and other hackers to perform the DDoS attack.

Rosol pleaded guilty and was agreed to direct pay for the losses as a result of the attack on the company website i.e. around $5,000 only, but Koch Industries had argued that it hired a consulting group to protect its web sites at a cost of approximately $183,000.

Unfortunately, the company website was knocked offline for just 15 minutes and now Eric has to pay the bill of the Cyber Security consulting group.

Similar crimes have also carried heavy punishments i.e. Jeremy Hammond, 28, Anonymous group member was sentenced last month to 10 years in prison for hacking various government agencies and a global intelligence company - Stratfor.

Monday, December 09, 2013 Mohit Kumar

Alleged Skynet Botnet creator arrested in Germany
The German Federal Criminal Police Office (BKA) has arrested a gang of cyber criminals believed to be responsible for creating the Skynet Botnet.

Skynet was first detected by Security Firm G DATA in December 2012. It is a variant of the famous Zeus malware to steal banking credentials with DDoS attack and Bitcoin mining capabilities. The Botnet was controlled from an Internet Relay Chat (IRC) server hidden behind Tor network in order to evade sinkholing.
According to a press release from German police, they arrested two people suspected of illegally generating Bitcoins worth nearly $1 million using a modified version of existing malware i.e. Skynet Botnet.

German police conducted raids earlier this week on 3rd December and found evidence of other hacking activities i.e. Fraud and distribution of copyrighted pornographic material. A third person is under suspicion but has not been arrested.

However, Police didn't mention Skynet Botnet in their press release, but just a day after the arrest, Thomas Siebert - Security Researcher at G DATA has also confirmed that the Skynet Botnet authors were arrested by the German Police on 3rd December, 2013.

On 6th December, twitter account of Skynet author tweeted:
'You have the wrong guy. Use this tweet as evidence to do the right thing and release him.'
According to MalwareTech blog post, 'It would seem the tweet is an automated message or he requested a friend post it in the event of his arrest.'
Alleged Skynet Botnet creator arrested in Germany
Last year, hacker on a Reddit post described that they have successfully compromised more than 15,000 systems  and  once infected, the malware downloads Bitcoin miners, exploit computational resources of the victim system and uses them in the mining process.
“My Botnet only mines if the computer is unused for 2 minutes and if the owner gets back it stops mining immediately, so it doesn't suck your fps at MW3. Also its mines as low priority so movies don't lag. I also set up a very safe threshold, the cards work at around 60% so they don't get overheated and the fans don't spin as crazily.”
A Botnet network behind the Tor network makes it much harder for researchers and law enforcement agencies to identify the malware operators and to shut down the server.

It is not clear at the time of writing that Skynet Botnet servers are taken down or not by the German Police, but we have not seen any tweet from the author's account since 6th December.

Stay Tuned to +The Hacker News ! We will let you know the related updates about the case.

Newsletter Subscription

Subscribe to our newsletter and get all latest hacking news, free eBooks delivered to your inbox.

Join Over 450,000 Subscribers!