The Hacker News | #1 Trusted Source for Cybersecurity News — Index Page

A security researcher responsibly disclosed vulnerabilities in the poorly secured web domains of a Florida county elections, but he ended up in handcuffs on criminal hacking charges and jailed for six hours Wednesday. Security researcher David Michael Levin, 31, of Estero, Florida was charged with three counts of gaining unauthorized access to a computer, network, or electronic instrument. On 19 December last year, Levin tested the security of Lee County website and found a critical SQL injection vulnerability in it, which allowed him to access site's database, including username and password. Levin was reportedly using a free SQL testing software called Havij for testing SQL vulnerabilities on the state elections website. According to Levin, he responsibly reported vulnerabilities to the respective authorities and helped them to patch all loopholes in the elections website. Video Demonstration of the Elections Website Hack Meanwhile, Levin demonstrates his finding via...

In Brief The Smartphone users are fed up with slow security updates, so two United States federal agencies have launched an official inquiry to know how manufacturers and carriers deal with mobile phone security updates and what they are doing to roll out patches as quickly as possible. The Smartphone patch update mechanism is broken, and someone has to fix it. Most smartphone models are not receiving available security patches, and the risk of vulnerabilities , malware infections , and data loss are leaving consumers vulnerable to attacks and putting businesses and corporate networks at risk. The United States federal regulators want to know how and when mobile phone manufacturers and cell phone carriers release security updates to assure its users' security, amid mounting concerns over security vulnerabilities. The Federal Communications Commission (FCC) in partnership with the Federal Trade Commission (FTC) have launched its own, parallel inquiry into mobile devic...

If you wish to send iMessages from your Android smartphone to a friend who owns an iPhone, it's possible now, at least for those who own MacBooks and iMacs. A developer has come up with a smart solution to bring Apple's iPhone messaging platform to Android phones. Though the solution is not practical for most people, technical people and nerds can use it to send end-to-end encrypted iMessages. The solution is a smart hack, but the best part is: PieMessage totally works . Developed by Eric Chee, PieMessage needs an OS X client as a server to route messages to an Android device, enabling iMessage support on Android devices. So, it's the Mac that handles the entire workload. "Basically, what the Android client does is send the text to a MacBook," Chee said. "And uses the Mac's Messages app to send off the notification. When the Mac detects an incoming message, it will pass it back to the Android. So yes, there is both software you need to run on ...

Google has patched a high-severity vulnerability that has been around for the last five years, potentially leaving users' text messages, call histories, and other sensitive data open to snooping. The vulnerability, CVE-2016-2060, affects Android versions 4.3 and earlier that use the software package maintained by mobile chipmaker Qualcomm, according to a blog post published by security firm FireEye . The issue was first introduced in 2011 when Qualcomm released a set of new APIs (Application Programming Interfaces) for a network manager system service to the Android Open Source Project (AOSP) and later the "netd" daemon. Qualcomm modified the netd daemon for providing additional networking capabilities to your smartphone, including additional tethering capabilities, among other things. But unfortunately, the modification introduced a critical bug to the Android operating system that could allow low-privileged apps to gain access to your private data that is sup...

" Talent has no Age Limit " That's what I said for a 10-year-old Finnish boy on our official Facebook page while sharing his recent achievement with our readers i.e. Winning $10,000 bug bounty from Instagram . Last Tuesday when we at The Hacker News first acknowledged this talented boy and the flaw he discovered in image-sharing social network Instagram, I did not have an idea that the Facebook post would get an enormous response from our followers, encouraging me to introduce Jani to our website readers too. Those who aren't aware, Jani from Helsinki recently reported an Instagram bug to Facebook that allowed him to delete other Instagram users' comments just by entering a malicious code into the app's comment field. " I would have been able to eliminate anyone's comment from Instagram, even Justin Bieber, " Jani told a local newspaper. Jani responsibly disclosed the vulnerability details to Facebook, who owns Instagram, in February and ...

In Brief Arthur Budovsky, co-founder of popular digital currency business 'Liberty Reserve', was sentenced Friday to 20 years in prison for running a money laundering scheme for hackers, identity thieves, child pornographers and drug dealers around the globe. Since its inception, 2005, to the year 2013, when Liberty Reserve was shut down by authorities, the company processed more than $8 billion worth of transactions for more than 5.5 million users worldwide. He was also ordered to forfeit $122 million and fined $500,000. The co-founder of Liberty Reserve, a widely-used digital currency, was sentenced to 20 years in prison on Friday for running a global money-laundering scheme that operated as "the financial hub for cyber criminals around the world." Arthur Budovsky Belanchuk, 42, ran an online digital currency business out of Costa Rica called Liberty Reserve from around 2005 until it was shut down by the federal authorities in 2013 with the arrest of Bud...

Without adequate analysis and algorithms, mass surveillance is not the answer to fighting terrorism and tracking suspects. That's what President Obama had learned last year when he signed the USA Freedom Act , which ends the bulk collection of domestic phone data by US Intelligence Agencies. There is no doubt that US Government is collecting a vast quantity of data from your smartphone to every connected device i.e. Internet of the things , but… Do they have enough capabilities to predict and identify terrorists or cyber criminals or state-sponsored hackers before they act? Well, if they had, I would not be getting chance to write about so many brutal cyber attacks , data breaches, and terrorist attacks that not only threatened Americans but also impacted people worldwide. The Ex-NSA technical director William E. Binney, who served the US National Security Agency for over 30-years, said last year in the front of Parliamentary Joint Committee that forcing analysts t...

In Brief What would you do if you get access to a Quantum Computer? IBM Scientists launches the world's first cloud-based quantum computing technology, calling the IBM Quantum Experience, for anyone to use. It is an online simulator that lets anyone run algorithms and experiments on the company's five-qubit quantum computer. Quantum computers are expected to take the computing technology to the highest level, but it is an experimental and enormously complex technology that Google and NASA are working on and is just a dream for general users to play with. Hold on! IBM is trying to make your dream a reality. IBM just made its new quantum computing project online ( with tutorials ), making it available for free to anyone interested in playing with it. Quantum Computers — Now A Reality! The technology company said on Wednesday that it is giving the world access to one of its quantum computing processors, which is yet an experimental technology that has the potential...

OpenSSL has released a series of patches against six vulnerabilities, including a pair of high-severity flaws that could allow attackers to execute malicious code on a web server as well as decrypt HTTPS traffic . OpenSSL is an open-source cryptographic library that is the most widely being used by a significant portion of the Internet services; to cryptographically protect their sensitive Web and e-mail traffic using the Secure Sockets Layer (SSL) or Transport Layer Security (TLS) protocol. One of the high-severity flaws, CVE-2016-2107 , allows a man-in-the-middle attacker to initiate a " Padding Oracle Attack " that can decrypt HTTPS traffic if the connection uses AES-CBC cipher and the server supports AES-NI. A Padding Oracle flaw weakens the encryption protection by allowing attackers to repeatedly request plaintext data about an encrypted payload content. The Padding Oracle flaw ( exploit code ) was discovered by Juraj Somorovsky using his own developed tool c...

A massive database of 272 million emails and passwords for popular email services, including Gmail, Microsoft, and Yahoo, are being offered for sale on the Dark Web for less than $1, media reports. An anonymous Russian hacker, who goes by the moniker " the Collector ," was first spotted by cybersecurity firm Hold Security advertising 1.17 Billion user records for email accounts on a dark web forum. The stolen credentials apparently came from some of the world's biggest email providers, including Gmail, Yahoo, Microsoft and Russia's Mail.ru. When security analysts at Hold Security reached out to the hacker and began negotiating for the dataset to verify the authenticity of those records, the hacker only asked for 50 Rubles (less than a buck) in return of the complete dump. However, it seems that there is actually nothing to worry about. Hold Security CEO Alex Holden said that a large number of those 1.17 Billion accounts credentials turned out to be duplicate an...