The Hacker News | #1 Trusted Source for Cybersecurity News — Index Page

In JULY Kaspersky Lab and Seculert revealed the presence of a new cyber-espionage weapon known targeting users in the Middle East. Despite the recent uncovering of the 'Madhi' malware that has infected several hundred computers in the Middle East, researchers say the virus is continuing to spread. The malware, known as 'Mahdi' or 'Madi', was originally discovered by Seculert. In addition to stealing data from infected Windows computers, it is also capable of monitoring email and instant messages, recording audio, capturing keystrokes and taking screenshots of victims' computers. Working together, researchers at Seculert and Kaspersky sinkholed the malware's command and control servers and monitored the campaign. What they found was a targeted attack that impacted more than 800 victims in Iran, Israel and other countries from around the globe. Israeli security company Seculert said it had identified about 150 new victims over the past six weeks as deve...

How Hacker culture has contributed to the rise of the United States economy and one possible reason why it is now in decline…   by  Paul F. Renda,  Author at  The Hacker News Magazine This article is about how hacker culture has benefited the economy of the United States. It represents the creative, ingenious and innovative ideas that characterize the U.S. Also, how this sub-culture was created by the first US hacker Benjamin Franklin... Countries of the world marveled at The United States and its innovation, creativity, devices, ideas, gadgets and large middle-class. This innovation comes from the culture of a specific group. We have a hacker type culture, and when I say hacker type culture, it's not just a culture of hacking computers and electronic components, but a culture of hacking (reverse engineering) whatever innovative idea or high technology of the time. The high technology of Franklin's era could be farm implements, stoves (Franklin), light bulbs, stea...

Another Cyber attack on Sony this year, Hacking group called " NullCrew " hack into one of the biggest site of Sony mobile website (www.sonymobile.com) and leak complete database on Internet. Nullcrew releasing their hack dumps from their official twitter account @OfficialNull. The dump of database released on Pastebin with a small note from Hackers as given below: Sony, we are dearly dissapointed in your security. This is just one of eight sony servers that we have control of. Maybe, just maybe considering IP addresses are available. Maybe, just maybe it's the fact that not even your customers can trust you. Or maybe, just maybe the fact that you can not do anything correct technologically Stats of Dump: 441 Members Username with Email Addresses  24 User names with Hashed password from Think_Users table  3 Admin user data from admin_user table Not just Sony, Nullcrew recently hack into Cambodia Army website and dump database. " Recently the co-founder ...

Adobe has released an update for Photoshop CS6 that closes a critical heap-based buffer overflow vulnerability ( CVE-2012-4170 ) in its popular graphics editing program. Both the Mac and Windows versions of Photoshop CS6 (aka Photoshop 13.0) contain a critical vulnerability that could allow an attacker to take control of affected systems. Furthermore, company officials say Adobe is unaware of any attacks against this vulnerability.That said, the Photoshop 13.0.1 update contains 75 other bug fixes, including 31 for problems known to cause crashes, 18 pertaining to 3D features, and 15 for drawing and graphics features. Adobe said that users and administrators can download and install the patch by lunching the "update" tool within the Photoshop help menu.The company credited a pair of Secunia researchers in discovering and reporting the flaw directly. According to a Secunia advisory , the problem is caused by a boundary error in the "Standard MultiPlugin.8BF" modul...

Gottfrid Svartholm Warg , one of the founders of the file sharing website The Pirate Bay has been arrested in Cambodia after an international warrant was issued following a conviction in Sweden for copyright violations. The Swedish foreign ministry has confirmed only that a Swedish man "in his thirties" has been arrested in Phnom Penh. In May 2006, police seized The Pirate Bay's servers from the ISP PRQ's headquarters in Stockholm. Since then, the file-sharing site appeared in the headlines, especially after the high-profile trial in 2008 in which the principals were sentenced to prison terms and hefty damages. The ruling was appealed, but in February 2012, the Supreme Court not to discuss the case further. Svartholm Warg's lawyer Ola Salomonsson confirms that it is TPB-founder who now sits arrested, but says he does not know for what reason.Sweden has no formal extradition treaty with Cambodia, but that does not mean Svartholm Warg is safe. According to lawyer ...

The two students accused of Sony Pictures hack participated in Cyber Defense Competition team exercises at the University of Advanced Technology in Arizona. US authorities have reportedly arrested a second suspected member of hacking group LulzSec on charges of taking part in an extensive computer breach of Sony Pictures Entertainment. Raynaldo Rivera, 20, of Tempe, Arizona, surrendered to the FBI in Phoenix six days after a federal grand jury in Los Angeles returned an indictment charging him with conspiracy and unauthorised impairment of a protected computer. In September 2011 charged Cody Kretsinger, then 23, with being Recursion. This week, meanwhile, the FBI announced the arrest of Raynaldo Rivera, 20, after he was recently indicted by a federal grand jury on charges of conspiracy and the unauthorized impairment of a protected computer. Two men who've been arrested on charges that they hacked into the website of Sony Pictures Entertainment and posted stolen data studi...

Kaspersky Lab publishes research resulting from the digital forensic analysis of the hard disk images obtained from the machines attacked by the Wiper - a destructive malware program attacking computer systems related to oil facilities in Western Asia. Security researchers from Kaspersky Lab have uncovered information suggesting a possible link between the mysterious malware that attacked Iranian oil ministry computers in April and the Stuxnet and Duqu cyber espionage threats. The malware wipes data from hard drives, placing high priority on those with a .pnf extension, which are the type of files Stuxnet and Duqu used, and has other behavioral similarities, according to Schouwenberg. It also deletes all traces of itself. As a result, researchers have not been able to get a sample, but they've reviewed mirror images left on hard drives. Kaspersky's researchers were not able to find the mysterious malware, which was given the name Wiper, because very little data from the aff...

Months after Hewlett-Packard originally announced the open-source version of WebOS , the beta version of the platform is on its way out the door. Friday's release includes two environments for developers.  The first is the desktop build, which is boasted to provide "the ideal development environment" for designing the webOS user experience with more features and integrating other open source technologies on the Ubuntu desktop. The second is the OpenEmbedded build for porting webOS to new devices. Equipped with an ARM emulator for running db8 and node.js services, HP cited that it included OpenEmbedded because of its "widespread community adoption" and cross-compiling support for embedded platforms. The news is getting announced in a blog post : " It has taken a lot of hard work, long hours and weekend sacrifices by our engineering team to deliver on our promise and we have accomplished this goal ," the developers write on the site devoid of any HP branding. T...

Oracle released an emergency patch on Thursday for previously unknown Java vulnerabilities that cybercriminals had targeted with popular exploit kits within hours after the bugs' existence became public, security researchers found yet another vulnerability that can be exploited to run arbitrary code on systems that have the runtime installed. Security researchers from Poland-based security firm Security Explorations claim to have discovered a vulnerability in the Java 7 security update released Thursday that can be exploited to escape the Java sandbox and execute arbitrary code on the underlying system. While so far the vulnerability has only been found being used against Windows, other platforms such as the Mac OS could potentially be targeted through the same exploit. Security Explorations sent a report about the vulnerability to Oracle on Friday together with a proof-of-concept exploit, Adam Gowdiak, the security company's founder and CEO said Friday via email. The compa...

The Air Force Life Cycle Management Center posted a broad agency announcement recently, calling on contractors to submit concept papers detailing technological demonstrations of 'cyberspace warfare operations' capabilities.  Air Force is seeking to obtain the abilities to 'destroy, deny, degrade, disrupt, deceive, corrupt, or usurp the adversaries' ability to use the cyberspace domain for his advantage' and capabilities that would allow them to intercept, identify, and locate sources of vulnerability for threat recognition, targeting, and planning, both immediately and for future operations. According to the document the issuing Program Office "is an organisation focused on the development and sustainment of Cyberspace Warfare Attack capabilites that directly support Cyberspace Warfare capabilities of the Air Force." Technologies that can map data and voice networks, provide access to the adversary's information, networks, systems or devices, manip...

Reports have surfaced that liquified natural gas (LNG) producer RasGas , based in the Persian Gulf nation of Qatar, has been struck by an unidentified virus, this time shutting down its website and email servers. The malware, however, did not affect the company's operational computers that control the production and delivery of gas, an official of the Ras Laffan Liquefied Natural Gas company. The attack reportedly began Aug. 27. The RasGas website was still unavailable on Thursday, three days after the attack. For the second time in two weeks a virus outbreak has been reported at an energy company in that region. Earlier this week the Saudi Aramco oil company confirmed that its network was hit by a virus two weeks ago, shutting down 30,000 workstations. Neither company identified the virus, but in at least one of the cases it is believed to be malware known as "Shamoon." A joint venture between Qatar Petroleum and ExxonMobil, RasGas exports about 36.3 million tons of liq...

Oracle has released a new patch which kills off a vulnerability in Java 7 that was being exploited by malware developers. " Due to the high severity of these vulnerabilities, Oracle recommends that customers apply this Security Alert as soon as possible ," Eric Maurice, the company's director of software security assurance. The out-of-band Security Alert CVE-2012-4681 includes fixes for "three distinct but related vulnerabilities and one security-in-depth issue" affecting Java running within the browser. Users with vulnerable versions of Java installed can have malware silently planted on their systems just by browsing to a hacked or malicious website unknowingly.Java is a free programming language widely used to enable every day programs and website elements to function, including some games, apps and chat, as well as enterprise apps. The attacks using this vulnerability so far have been Windows-based, the exploit was demonstrated on other platforms supported by Java...

Russian anti-virus company Doctor Web reported about the first cross-platform backdoor to run under Linux and Mac OS X identified as " BackDoor.Wirenet.1 ". This malicious program designed to steals passwords entered by the user in Opera, Firefox, Chrome, and Chromium, and passwords stored by such applications as Thunderbird, SeaMonkey, and Pidgin. BackDoor.Wirenet.1 is the first-ever Trojan that can simultaneously work on these operating systems. BackDoor.Wirenet.1 is still under investigation. At launch BackDoor.Wirenet.1 creates a copy in the user's home directory. To interact with the command server located at 212.7.208.65, the malware uses a special encryption algorithm Advanced Encryption Standard (AES). BackDoor.

Yesterday someone anonymously posted on Slashdot that The Pirate Bay had launched a free VPN service called PrivitizeVPN ( https://freevpn.thepiratebay.se/ ) . But Just today team at torrentfreak confirms on behalf of team The Pirate Bay that its not  a Pirate Bay project. They're just running it as an ad next to the regular download links. According to people close to PrivitizeVPN they are working on the connectivity issues. Till now according to PrivitizeVPN statics more than 45,091,927  users Downloads VPN client after the fake news that " The Pirate Bay team is going to be making the RIAA angry, with the launch of a new ad-supported VPN service "

FireEye's Malware Intelligence Lab is making the claim that there is a new zero day vulnerability in the wild that affects the latest version of Java.Researcher. Atif Mushtaq wrote on the company's blog that he spotted the initial exploit on a domain that pointed to an IP address in China. The vulnerability allows computers to be infected by simply visiting a specially crafted web page, and the malware served in the current attacks contacts a C&C server in Singapore. Researchers from heise Security have also created a PoC page using information that is publicly available. A separate post published on Monday by researchers Andre M. DiMino and Mila Parkour said the number of attacks, which appear to install the Poison Ivy Remote Access Trojan, were low. But they went on to note that the typical delay in issuing Java patches, combined with the circulation of exploit code, meant it was only a matter of time until the vulnerability is exploited more widely by other attackers. ...

TeamGhostShell  a team linked with the Activist group Anonymous, is claiming that they have hacked some major U.S. institutions including major banking institutions, accounts of politicians and has posted those details online. The dumps comprising of millions of accounts has been let loose on the web by the hacking collective. The motivation behind the hack, the group claims, is to protest against banks, politicians and the hackers who have been captured by law enforcement agencies. The group justifies its operation, Project HellFire, as a " final form of protest this summer against the banks, politicians and for all the fallen hackers this year ". Hacker also announced the public data of this phase is only the beginning, the group will continue to coordinate with organizations hacker raging world's most powerful Anonymous for two more planned later this year. According to initial information, the data may have been stolen from the organizations like CIS Services (not related t...

Anonymous Operation #OpColtan have announced another attack in the name of this operation and this time its on a Manufacturer and Supplierof Electronic Components AVX Corporation (www.avx.com). AVX It's a big firm wich produce ceramic and tantalum capacitors, connectors, thick and thin film capacitors, resistors and integrated passive components.  UN accused AVX, and many other firms to be interested in illegal coltan extraction and war in DRC. According to Hackers " Usually Coltan was stealed by war groups from Congo mines and carried out to the firms.Million of people lost their lives in Congo war, nature was destroied in order to dig coltan and a lots of gorillas were killed.Unfortunatelly UN decided to abandon the case and never punish the responsibles of the war an nature devastation ." " AVX and other involved firms published an ethical code in 2010; they claim that they don't get tantalium from war areas.NOW a new civil war is growing up in Congo and is...

Saudi Aramco, the world's biggest oil producer, has resumed operating its main internal computer networks after a virus infected about 30,000 of its workstations in mid-August. Immediately after the Aug. 15 attack, the company announced it had cut off its electronic systems from outside access to prevent further attacks. Saudi Aramco said the virus "originated from external sources" and that its investigation into the matter was ongoing. There was no mention of whether this was related to this month's Shamoon attacks. " The disruption was suspected to be the result of a virus that had infected personal workstations without affecting the primary components of the network, " Saudi Aramco said over Facebook . " We would like to emphasize and assure our stakeholders, customers and partners that our core businesses of oil and gas exploration, production and distribution from the wellhead to the distribution network were unaffected and are functioning as reliably as ever...

Security researchers have revealed the existence of an advanced persistent threat that has been making the rounds since April 2011.  Backdoor.Hikit  is a dangerous backdoor Trojan that will damage infected system and files. Usually, Backdoor. Hikit will open backdoor to allow remote attackers to connect to the infected system and carry out harmful activities, such as stealing information or destroying files and programs. It is really stubborn those antiviruses often fail to delete it for good, for it runs secretly and automatically when Windows boots without your knowledge or consent and can disguise it as fake system files or processes. Besides, many other threats, such as adware, redirecting virus, Trojan variants from family, such as Trojan Horse Generic 27.PN, BackDoor.Hupigon5.CJMY, Trojan.Zeroaccess.C, Trojan:win64/Sirefef.E and so on, which is really a threat to system and data security. According to experts from security firm Symantec , it all starts with the unknow...

Hackers claiming allegiance to the Anonymous movement of cyber-rebels have defaced the website of a former British cabinet minister in solidarity with WikiLeaks founder Julian Assange. " If the reason ... is revenge for Assange's treatment, it's weird to attack me," Hain said in comments carried by the BBC. "They have not done their research because I have supported Assange and opposed his extradition. " Hain's website was defaced Saturday by a group calling itself Anonymous UK, whose logo consisted of a dark, headless suit against a Union Jack. The group made a variety of allegations against the 62-year-old Labour Party politician, before adding: " The UK's persecution of Julian Assange will NOT be forgotten ." Assange's fight to avoid extradition took a dramatic turn in June, when Assange fled to the Ecuadorean Embassy seeking refuge. The ensuing standoff sparked a diplomatic crisis between Britain and Ecuador and could potentially drag on for months...

Let's forget the political mumbo jumbo and posturing going on between countries about the release of Julian Assange. It is time to approach this in a "Sho-Gun" switch-a-roo style and get this over with. If not, we are going to be reading endless editorials and opinions about who is doing what, and what is doing who. Ugggh. With the help of the Ecuadorian Administration and some well planned orchestration with the group Anonymous, we can do this. Let's let the Guy Fawkes mask slide us into victory with my new handy dandy plan that is sure to get the by now, haggard and worried Assange, into Ecuadorian freedom and fame. It is simple really. We need a call to arms, a ready army of Anons that can be recruited at a moments notice to storm the embassy. Just stop for a minute and picture it. Hundreds, no thousands, of masked Anons, wearing black, storming the embassy at night and throwing a wig on Assange and, of course, a mask (I am sure he has one) and moving him out into the crowd...

Many malware and viruses can be identified by detection software because of known bits of malicious code. But what if there was a virus compiled from little bits of programs you already had installed? That's just what two security researchers are looking into. Frankenstein or The Modern Prometheus is a classic story in which a doctor creates life through technology in the form of a creature assembled from the parts of dead men. While this biological idea exists only in fiction, researchers have recently used it to craft a very ingenious piece of malware. Vishwath Mohan and Kevin Hamlen at the University of Texas at Dallas are interested in how malware disguises itself in order to propagate more widely. In Windows Explorer alone, Frankenstein found nearly 90,000 gadgets in just over 40 seconds, which means that malware created by the system would have a huge number of possible variations, work quickly, and be very difficult to detect. Frankenstein follows pre-written blueprints ...

Turkish hackers recently hacked the Web site of soccer team FC Spartak Moscow after the Russian team's fans burned Turkish flags and pictures of Atatürk during a Champions League playoff match against Turkish team Fenerbahce on August 21. A portrait of Atatürk next to a Turkish flag was also posted on the website. The group replaced the website's original content with a statement that called on the team to "immediately apologize." " You will immediately apologize to the Turkish Republic and the Turkish people. No crime goes without punishment, and FIFA may forgive you, but we won't ," The Spartak site was running again by Thursday afternoon after the club used its Twitter account to blame the incident on 'Turkish hackers. Spartak Moscow fans burned flags and posters of modern Turkey's founding father, Mustafa Kemal Atatürk, during their team's 2-1 victory over the Istanbul giants in the first leg of their Champions League playoff.

NetWeirdRC is a commercial backdoor tool targeting Mac OS X 10.6 and later, as well as Windows, Linux and Solaris, according to Intego . The product is sold for US$60 in the malware world, relatively cheap in comparison to the OSX/Crisis malware that was being sold for €200,000 ($240,000). It's a commercial remote access tool, that after installation, calls home to the IP address 212.7.208.65 on port 4141 and awaits instructions. Then it carries out functions including installing files, gathering system information, stealing browser passwords and grabbing screen shots. In addition, it said, the malware can " harvest stored and encrypted usernames and passwords from Opera, Firefox, SeaMonkey, and Thunderbird browsers and mail clients ." It's able to infect Apple OS X (versions 10.6 and newer), Linux, Solaris, and Windows systems.

Note : This Article Cross posted from our Magazine's 13th Issue - August 2012 called "BOTNET | The Hacker News Magazine", Written by Ann Smith (Executive Editor, The Hacker News Magazine). You can Download full magazine free here . Shame on me.  When someone mentioned Lulzsec I would slightly bristle and turn a mighty heel towards the "real" movement.  You know, the Anons that are taking down corruption and terror, targeting the real enemies of the world.  If you were doing it for the LULZ of it, well, you were playing in the proverbial sand box and I thought you were hindering, instead of helping.  I even wrote an editorial spanking them for releasing the emails of servicemen who had signed up for a porn site.   Then, I read the book, WE ARE ANONYMOUS by Parmy Olson. Every person who considers themselves Anonymous or who  sympathizes and rallies for the cause, must read this book.  You will not only get a good education from this history ...

Today was the day that Hector Xavier Monsegur, a.k.a. Sabu, Xavier DeLeon, and Leon, was supposed to be sentenced for the 12 counts of computer hacking conspiracies and other crimes he pleaded guilty to, including the infamous hacks of HBGary Federal, HBGary, Sony, Fox, and PBS, but he has had his sentencing delayed, perhaps as a reward for assisting the US police with their enquiries and investigations. Monsegur allegedly rooted out the vulnerabilities used in the hacks conducted by LulzSec, which went on a high-profile tear in 2011 that exposed emails, documents, and other information of its victim organizations. Sabu is the hacker nom de plume of 28-year-old New Yorker Hector Monsegur, an unemployed father of two who allegedly commanded a loosely organized, international team of perhaps thousands of hackers from his nerve center in a public housing project on New York's Lower East Side. According to the FBI, he could face a maximum sentence of 124 years and six months for 12 offe...

The U.S. Department of Homeland Security has issued an alert warning that hackers could exploit code in Siemens-owned technology to attack power plants and other national critical infrastructure. Justin W. Clarke, an expert in securing industrial control systems, disclosed at a conference in Los Angeles on Friday that he had figured out a way to spy on traffic moving through networking equipment manufactured by Siemens' RuggedCom division. RuggedCom, a Canadian subsidiary of Siemens that sells networking equipment for use in harsh environments such as areas with extreme weather, said it was investigating Clarke's findings, but declined to elaborate. Clarke said that the discovery of the flaw is disturbing because hackers who can spy on communications of infrastructure operators could gain credentials to access computer systems that control power plants and other critical systems. According to security researcher Justin W. Clarke, Rugged OS contains the same private key used...

Websense ThreatSeeker Network intercepted a malware campaign targeting BlackBerry customers. These fake emails state that the recipient has successfully created a BlackBerry ID. According to Security Labs , those users who are targeted receive an email with the subject line " Your BlackBerry ID has been created ." The email encourages users to follow instructions in the attached file on how to " enjoy the full benefits " of their ID. The malware comes attached to an email that is an exact copy of the email you receive when creating a new BlackBerry ID. It teases you by asking you to download an attachment that allows you to fully appreciate the BlackBerry user experience. Those who open the attached .zip file will drop a handful of executable files that will modify the system registry to start malware programs upon the machine's next startup.

Police on Thursday rounded up 357 foreigners accused of duping Taiwanese and Chinese citizens in an online scam in what an official described as the largest single-day operation against organized crime in the country.  Director Samuel Pagdilao Jr., CIDG director, said CIDG and Paocc agents led by Senior Supt. Ranier Idio raided 20 houses in several subdivisions in Quezon, Manila, Marikina, Cainta and Antipolo cities at around 6:30 a.m. on Thursday and they rounded up the foreigners. The suspects were brought to the Police National Training Institute (PNTI) in Camp Vicente Lim in Laguna. They face charges for violating the Access Device Act. The syndicate's operations involve the use of the internet, wherein the group will call unsuspecting victims in China, claiming that they represent police, prosecutor's office, courts, insurance companies, banks, and other financial institutions. The syndicate raked in at least P20 million ($472,000) each day using the scam, Pagdilao said...

Vehicles are becoming more and more reliant on computers for efficiency, safety systems, and infotainment systems. Most vehicles on the market today use throttle-by-wire systems, where the onboard computer controls the throttle of the vehicle. Toyota has had problems in the past with so-called unintended acceleration, with many pointing fingers at the electronic systems in the car. Intel's McAfee unit, which is best known for software that fights PC viruses, is one of a handful of firms that are looking to protect the dozens of tiny computers and electronic communications systems that are built into every modern car. McAfee, makers of the popular anti-virus software, are just one of the teams looking to protect automobiles from many bugs and viruses which could wreak havoc on the tiny computers inside modern cars. " You can definitely kill people ", said John Bumgarner, chief technology officer of the U.S. Cyber Consequences Unit, a non-profit organization that helps companies an...

The Windows version of Crisis , a piece of malware discovered in July, is capable of infecting VMware virtual machine images, Windows Mobile devices and removable USB drives, according to researchers from antivirus vendor Symantec.The installer was actually a Java archive (JAR) file which had been digitally signed by VeriSign. Crisis is distributed via social engineering attacks that trick users into running a malicious Java applet. The applet identifies the user's OS, Windows or Mac OS X and executes the corresponding installer. " The threat uses three methods to spread itself: one is to copy itself and an autorun.inf file to a removable disk drive, another is to sneak onto a VMware virtual machine, and the final method is to drop modules onto a Windows Mobile device ," Symantec explained in a blog post . Malware authors are putting significant efforts into making sure that new variants of their Trojan programs are not detected by antivirus products when they are released. Also...

The website of  the Moscow district court that sentenced three members of the band Pussy Riot to jail has been attacked by hackers posting anti-Putin messages. As well as the anti-Putin slogan Anonymous Russia posted an appeal for the band's release as well as a video clip of one of the band's songs.The slogan read: " Putin's thieving gang is plundering our country, wake up comrades! " In a message posted on the website, the hackers said the in Russian that :  We are American group Anonymous. We don't forget and we don't forgive. Justice system has to be transparent. Pussy [Riot's members] are alive. Another caption called for the release of the band's jailed members - Nadezhda Tolokonnikova, 22, Marina Alyokhina, 24, and Yekaterina Samutsevich, 30. Jude Marina Syrova said that the women had grossly violated public order and " deeply insulted the faith of the believers with their disrespectful criminal act " when they took over a church pulpit in Moscow's Chri...