The Hacker News | #1 Trusted Source for Cybersecurity News — Index Page

Wireless Penetration Testing Series Part 2: Basic concepts of WLANs This blog post is in continuation of the Wireless Penetration Testing and Hacking series we started ( Part 1: Getting Started with Monitoring and Injection ) on the basis of the “SecurityTube Wi-Fi Security Expert” ( SWSE ) course which is based on the popular book “ Backtrack 5 Wireless Penetration Testing ”. In the third video, the instructor talks about some of the basic concepts of WLANs. We learn that communication over WLAN's happens over frames. There are mainly 3 types of WLAN frames which are Management frames, Control frames, and Data frames. These types of packets also have different subtypes . We learn that an SSID is a name given to an Access point or a network consisting of multiple Access points. We then learn about Beacon frames which are broadcast frames sent out periodically by Access point to broadcast their presence in the current RF (Radio frequency) vicinity. The instructor then starts wire...

Saudi hacker target Israeli stock exchange and National air carrier Saudi cyber Hacker OxOmar  struck again on Monday. This time disrupted the websites of Israel's stock exchange and National air carrier. Last week he had leaked private information about more than 400,000 Israelis. Credit card companies said around 25,000 numbers, some of them expired, had been posted . The pro-Palestinian group is referring to itself as “ Nightmare .” The site of El Al crashed but officials at Israel's flag carrier would not confirm or deny the incident was the work of hackers. A person familiar with the situation at El Al Israel Airlines says the carrier took down its website Monday after the alleged Saudi hacker network behind previous attacks warned that both sites would be targeted. " There has been an attack by hackers on the access routes to the (TASE) website. The stock exchange's trading activities are operating normally ," said Orna Goren, deputy manager of the excha...

Nigerian Army Education site hacked by Nigerian Hacktivists Today the official website of Nigerian Army Education Corps ( NAEC ) got defaced by some Nigerian Hacktivists, He tweeted . The Complete message posted by Hackers as shown below:

Hacker will release full Norton Antivirus code on Tuesday A hacker with code name of ' Yama Tough ' announce via Twitter that on Tuesday he will leak the full source code for Symantec Corp's flagship Norton Antivirus software which is 1,7Gb src. Last week Yama Tough has released fragments of source code from Symantec products along with a cache of emails. The hacker says all the data was taken from Indian government servers. Yama Tough is trying to prove that Indian government was snooping on America and China. YamaTough said via Twitter " Pass it on to forensics and win the lawsuit ,".He has offered support to an American man who filed a lawsuit against Symantec Corp by publishing source code from a 2006 version of Norton Utilities, a software program at the heart of the legal dispute. It was not immediately clear how the source code might help the case. A Symantec spokesperson commented on the incident: " We are still gathering information on ...

Data Stealing Malware on Internal Computer of  Japan Space Agency Japan Aerospace Exploration Agency (JAXA) announce that their computer has been infected with a virus, leading to a possible leak of data on its H-II Transfer Vehicle (HTV) the craft popularly known as Konotori that hauls cargo for the International Space Station (ISS). JAXA still isn't sure how the virus got on the computer, or who put it there. JAXA said the infection occurred on July 6 last year, when an employee in his 30s involved in the HTV's operation at the Tsukuba Space Center opened an e-mail attachment titled "bonenkai". An identical e-mail was also sent to several coworkers, but the employee accidentally opened the attachment as the sender had the same name as one of his friends. The space agency is working to minimize the damage and prevent further incursions. JAXA is now conducting an investigation into the leak and is checking other computers for viruses, according to the press releas...

Fake Angry Birds Game  spreading Malware from Android Market From last week premium rate SMS Trojans surfaced in the Android Market. Google has pulled 22 apps that are masquerading as legitimate versions of popular games like Angry Birds and Cut the Rope. Security researchers have discovered a way to bypass an Android smartphone owner's permissions and access private data stored on their smartphone. Avast Blog explain this as - For example, if someone tried to look for “Cut the rope free”, this malicious application was in the fourth place in the search results. Apps published by the developer Miriada Production may look like well known Android games (Angry birds, Need for speed, World of Goo and others) and users could be easily confused.  The fake apps include "Cut the Rope", "Need for Speed", "Assassins Creed", "Where's My Water? ","Riptide GP", "Great Little War Game", "World of Goo", "Angry Bir...

 Zappos a division of Amazon got Hacked A notification mail from Zappos is circulating in Customers that a division of Amazon " Zappos.com " got Hacked by Unknown Hackers. Notification mail indicated that names, email addresses, mailing addresses, and the last four digits of customer's social security numbers have been compromised. Also the databases that contain sensitive billing information, such as credit card numbers, was not accessed by hackers. According to messages from Zappos CEO Tony Hsieh to employees and customers: Zappos are currently working with law enforcement for an investigation.

Security Enhanced (SE) Android Released by National Security Agency (NSA) The National Security Agency (NSA) releases the first version of Android Security Enhanced . The system is designed to minimize the impact of security holes on Android . SE Android project is enabling the use of SELinux in Android in order to limit the damage that can be done by flawed or malicious apps and in order to enforce separation guarantees between apps. However, the scope of the SE Android project is not limited to SELinux.  How can SELinux help Android? Confine privileged daemons. Protect them from misuse. Limit the damage that can be done via them. Sandbox and isolate apps. Strongly separate apps from each other and from the system. Prevent privilege escalation by apps. Provide centralized, analyzable policy. Distinctive features SE Android: Per-file security labeling support for yaffs2, Filesystem images (yaffs2 and ext4) labeled at build time, Kernel permission checks...

URL redirection Vulnerability in Google An open redirect is a vulnerability that exists when a script allows redirectionto an external site by directly calling a specific URL in an unfiltered,unmanaged fashion, which could be used to redirect victims to unintended,malicious web sites. A web application accepts a user-controlled input that specifies a link to an external site, and uses that link in a Redirect. A similar vulnerability is reported in Google by " Ucha Gobejishvili ( longrifle0x ) ".  This problem may assist an attacker to conduct phishing attacks, trojan distribution, spammers. Url: https://accounts.google.com/o/oauth2/auth?redirect_uri=http://www.something.com Same vulnerability in Facebook, Discovered by  ZeRtOx from Devitel group : http://www.facebook.com/l.php?h=5AQH8ROsPAQEOTSTw7sgoW1LhviRUBr6iFCcj4C8YmUcC8A&u=www.something.com Impact of Vulnerability  : The user may be redirected to an untrusted page that contains malwar...

Microsoft launching Real Time Hosted Threat Intelligence Feed Microsoft is to offer a real-time intelligence feed of botnet and e-crime data to public and private sector subscribers, according to security company Kaspersky. Currently, Microsoft is testing a real-time feed to distribute information collected from several sources on major botnets, including Rustock, Waldec and Kelihos networks. Partners would be able to access the information using application program interfaces (APIs) that would be provided free by Microsoft. Data from networks of compromised computers will be among the information on offer to ISPs, CERTs, government agencies and private companies, Kaspersky said . Microsoft will have a lot of data in this system already as anyone who has watched the company’s spectacular attacks on the Kelihos botnet last summer will attest, adding to similar campaigns against Rustock and Waledec, will vouch for. " Companies could use the data to look for opportunistic mal...

The Saudi hacker to Mossad " Don’t waste your time by searching for me "! In a response to the Israeli hackers, the Saudi hacker xOmar exposed 200 Israeli credit cards and he described the Israeli hackers by idiots and he said that they published invalid credit cards. And he asked Mossad through his website not to search for him, because they won't catch him.  xOmar threatened the Israeli people by exposing 200 credit cards daily, and all of these credit cards are valid. speaking about the latest efforts to locate his place, he said '' I've heard from some idiots saying that I am from Mexico, and another said that I am in Riyadh, and last one said that I am from Dubai " and he said to mossad in a message '' don't waste your time '' The Secretary-General of the Committee on Information and awareness of banking in Saudi banks '' Tal'at hafiz '' have told the " Arabiya.Net " yesterday that Saudi banks ha...

Self-extracting archive (SFX) as Creative Virus Handler Yesterday I Found and interesting article about " Self-extracting archive (SFX) " on Unremote.org by DarkCoderSc. SFX is a little application that contains compressed files. Creating a customized WinRAR SFX archives is a very easy task, but not all people know how to do it.  It is therefore exactly the same as a .ZIP or .RAR archive. The only difference is that, when you execute it, will automatically extract the files. However, if you add some parameters, you can execute them after extraction or execute a shell command before extraction. So this feature can be used as good virus handler. Let's See how? DarkCoderSc shared his experience with us using a Video Demonstration as shown Below. Start up the WinRAR application; click ‘Browse for folder’ under the ‘File’ menu and browse to the location of the file. With the file highlighted, clicking on the ‘Add’ button will kickoff the archiving process and sele...

Warm up the keyboard, Its time for February The Hacker News Magazine ! Warm up the keyboard, hack into the internet security of your mind and help us fill the February The Hacker News Magazine with fun, interesting and educational web security info. Our readers love to see what you are up to and what the industry is creating and manufacturing for anyone who turns on their computer and wonders if today is the day they will be hacked into cyber space! Mostly, what they can do about it and how they can protect themselves. Topics of interest include, but are not limited to the following: - New Attack and Defense Techniques - Vulnerability discovery - Small Tactics & Techniques - Big Attacks & Impact - Mobile Hacking - Professional Exploit Development - Security and Hacking Events Around The World - Technical Book Reviews - Security and Hacking Threats - Play with Security Tools - Expert Interview We welcome contributions from readers and hackers like YOU! ...

Stratfor Back Online After Hack with message for Anonymous Hacker Security analysis firm Stratfor has relaunched its website after Anonymous hackers brought down its servers and stole thousands of credit card numbers and other personal information belonging to its clients. Hacking collective Anonymous admitted the cyber attack on Christmas Eve and went on to claim that it used the stolen details to make $500,000 in charitable donations to The American Red Cross and Save the Children, as well as other charities.Anonymous eventually released the stolen data to the world, including 75,000 credit card numbers and 860,000 usernames and passwords. Approximately 50,000 of those belong to .mil or .gov email accounts used by the US government. " This was our failure ," Chief Executive George Friedman said in a message to Stratfor's subscribers. " I take responsibility. I deeply regret that this occurred and created hardship for our customers and friends. " Friedma...

US become victim of Indian spy unit, Apple & RIM deny their role ! A recently leaked memo reveals that American and Canadian based company’s Apple, Research in Motion and Nokia may have helped the government of India spy on U.S. agencies in order to receive larger shares of the overall Indian cell phone market. Last week, an Indian hacker crew successfully broke into a secured Indian military government network. The group, the Lords of Dharmaraja (who posted up outdated Norton security source code last week) posted documents that infer Apple, Nokia, and Research In Motion gave the Indian government backdoor access to their devices in exchange for mobile phone market rights. The US-China Economic and Security Review Commission (USCC) has asked for an investigation after hackers posted. " We are aware of these reports and have contacted relevant authorities to investigate the matter ," said USCC spokesman Jonathan Weston on Monday. " We are unable to make furthe...

Homeland Security have eye on Journalists The Department of Homeland Security has declared its intention to gather personal data on journalists or others who might use “ traditional and/or social media in real time to keep their audience situationally aware and informed ". Well, it'll be interesting to see the reaction of Obama's adoring White House press corps when they discover their activities are being tracked by the Department of Homeland Security. Under the National Operations Center (NOC)’s Media Monitoring Initiative that came out of DHS headquarters in November, Washington has the written permission to retain data on users of social media and online networking platforms. Congress shall make no law respecting an establishment of religion, or prohibiting the free exercise thereof; or abridging the freedom of speech, or of the press or the right of the people peaceably to assemble, and to petition the Government for a redress of grievances. The department says ...

Why shouldn't you protect your Android phone? Why to use an Antivirus for your Android? So that users can protect their devices from trojans, viruses, spyware, and other types of malware. Most people carry a lot of sensitive data on their phones. Recently an SMS Trojan horse posing as a media player began infecting Android phones on Russian networks. Once the victim installed the malicious app, it began sending text messages to premium numbers, leaving the user with a huge phone bill. Also Security researchers from Kaspersky Labs have intercepted a scareware variant targeting Android users, distributed as an Opera Virus Scanner. If the user clicks on the link, they’ll be asked to download VirusScanner.apk, which is currently detected as Trojan-SMS.AndroidOS.Scavir. If the user is using a non-Android device, they’ll be asked to download VirusScanner.jar currently detected as Trojan-SMS.J2ME.Agent.ij. With this in mind we at The Hacker News have list down the top 5 an...

Finnish ISP is blocking the Pirate Bay, Anonymous stand for Freedom of Expression ! Anonymous has urged its followers to target Finnish anti-piracy body the Copyright Information and Anti-Piracy Centre (CIAPC) after it persuaded the Helsinki District Court to force one of the country's biggest ISPs to block access to The Pirate Bay. One of the largest internet service providers in Finland, has been forced to block access to The PirateBay for its customers. Elisa issued a press release  on the matter moments ago. The decision was given by a local district court in Helsinki. Elisa has stated that they will seek correction to the decision in supreme court. " The Helsinki District Court ordered the Elisa 26.10.2011 temporarily suspend a penalty of copyright infringing material available to the public via the Pirate Bay ," it said in a statement. Numerous Twitter accounts linked with the Anonymous collective erupted with messages of discontent and - at times - threats of ...

FBI warning about Banking trojan " Gameover " Organized crooks have begun launching debilitating cyber attacks against banks and their customers as part of a smoke screen to prevent victims from noticing simultaneous high-dollar cyber heists. On Friday the FBI issued a warning about a banking trojan named Gameover. It’s a new variant of Zeus, a user credential stealing malware that targets online bank users. Zeus has been around for years, and every now and then a new version with a new twist pops up. Gameover has also been implicated in Distributed-Denial-of-Service attacks that temporarily-disable bank websites to draw attention away from fraudulent transactions. Like another Zeus variant, Troj/BredoZp-GY, Gameover uses e-mail spam to propagate, and the safest way to keep Gameover away from your PC is to avoid links and file attachments that are contained in unfamiliar e-mail messages. Experts warn that any interaction with this fake NACHA link can infect your PC with...

Smart Hacking For Privacy : What TV shows you watch ? White-hat hackers have exposed the privacy shortcomings of smart meter technology. At the Chaos Communication Congress in Germany, 28C3, researchers presented " Smart Hacking For Privacy " After analyzing data collected by a smart meter, these gentlemen were able to determine devices like how many PCs or LCD TVs in a home, what TV program was being watched, and if a DVD movie being played had copyright-protected material. Dario Carluccio and Stephan Brinkhaus demonstrated the flaws. Advanced metering devices (aka smart meters) are nowadays being installed throughout electric networks in Germany, in other parts of Europe and in the United States. Due to a recent amendment especially in Germany they become more and more popular and are obligatory for new and refurbished buildings. DarrellIssa The researchers, also customers, learnt that energy consumption data was sent unencrypted because SSL was malfunctioning.They int...

Hey @BarackObama ! Please don't extradite Gary McKinnon Gary McKinnon,  a Scottish systems administrator and hacker who has been accused of what one U.S. prosecutor claims is the " biggest military computer hack of all time " by hacking into the Pentagon, faces an ordeal of terrifying brutality if he is extradited to the United States. America wants to put him on trial, and if tried there he could face 60 years behind bars. Note : Request to Every Reader ! Please Re-Tweet/Share this article if you want to Support Gary McKinnon in the fight for justice. The mother Gary McKinnon has called for her son to stand trial in Britain claiming attempts to extradite him to the US have destroyed his life. He claims his motivation, drawn from a statement made before the Washington Press Club on 9 May 2001 by " The Disclosure Project ", was to find evidence of UFOs, antigravity technology, and the suppression of " free energy ", all of which he claims to have ...