The Hacker News | #1 Trusted Source for Cybersecurity News — Index Page

I'm assuming everyone reading already knows about Ophcrack – the awesome time/memory trade-off password cracker. Well here is a nifty web-based interface for it. Rainbow Tables are really useful when cracking password hashes, but one major disadvantage of these tables is their size which can be hundreds of gigs for complex tables. The author thought it would be extremely useful to have a personal web interface for your rainbow tables which you can access from anywhere on the web anywhere without having to carry the large tables with you everywhere you go. And well here we are, Wophcrack (Web) Ophcrack. When cracking LM or NTLM hashes Ophcrack is a great tool as we discussed recently, it provides both a GUI and CLI options along with some free and paid tables. The author basically wrote a quick and dirty PHP based web frontend for Ophcrack. Wophcrack was designed to work on Backtrack 4 R2, Although it can be install on any Linux distribution with some small adj...

OpenDNSSEC 1.2.1 latest version Released ! Version 1.2.1 of OpenDNSSEC has now been released. ldns 1.6.9 is required for bugfixes. dnsruby-1.52 required for bugfixes. Bugfixes: Auditor: 'make check' now works when srcdir != builddir. Auditor: Include the 'make check' files in the tarball. Enforcer: Fix the migration script for SQLite. Enforcer: Increase size of keypairs(id) field in MySQL to allow more than 32767 keys; see MIGRATION for details. Enforcer: Minor change to NOT_READY_KEY error message. libhsm: Increase the maximum number of attached HSM:s from 10 to 100. ods-ksmutil: Send trivial MySQL messages to stdout when exporting zonelist etc. Otherwise the resulting XML needs to be edited by hand. ods-control: Fix for Bourne shell. Signer Engine: Prevent race condition when setting up the workers and the command handler. Signer Engine: Check if the signature exists before recycling it. Signer Engine: Quit when there are errors in the configuration. Sign...

Update : The PHP Group has confirmed the compromise of their server ! : The Hacker News ~ https://www.thehackernews.com/2011/03/php-group-has-confirmed-compromise-of.html Php.net was compromised and php source backdoored ! The picture show that some php.net site was compromised,and hacker backdoored php source.

Just now Top security firm RSA Security revealed by extremely sophisticated hack, Read complete Story here - https://www.thehackernews.com/2011/03/top-security-firm-rsa-security-revealed.html Now, RSA Release Open Letter to RSA Customers , as given below : Like any large company, EMC experiences and successfully repels multiple cyber attacks on its IT infrastructure every day. Recently, our security systems identified an extremely sophisticated cyber attack in progress being mounted against RSA. We took a variety of aggressive measures against the threat to protect our business and our customers, including further hardening of our IT infrastructure. We also immediately began an extensive investigation of the attack and are working closely with the appropriate authorities. Our investigation has led us to believe that the attack is in the category of an Advanced Persistent Threat (APT). Our investigation also revealed that the attack resulted in certain information being extra...

Roboo uses advanced non-interactive HTTP challenge/response mechanisms to detect and subsequently mitigate HTTP robots, by verifying the existence of HTTP, HTML, DOM, Javascript and Flash stacks at the client side. Such deep level of verification weeds out the larger percentage of HTTP robots which do not use real browsers or implement full browser stacks, resulting in the mitigation of various web threats: HTTP Denial of Service tools - e.g. Low Orbit Ion Cannon Vulnerability Scanning - e.g. Acunetix Web Vulnerability Scanner, Metasploit Pro, Nessus Web exploits Automatic comment posters/comment spam as a replacement of conventional CAPTCHA methods Spiders, Crawlers and other robotic evil You can find the first public version  here

S ecurity E vent : Hack In Paris (16-17 June, 2011) Hack  In  Paris   is an international and corporate security event that will take place in Disneyland  Paris ® from June  16th to 17th of  2011 . Please refer to the homepage to get up-to-date information about the event. Topics The following list contains major topics the conference will cover. Please consider submitting even if the subject of your research is not listed here. Advances in reverse engineering Vulnerability research and exploitation Penetration testing and security assessment Malware analysis and new trends in malicous codes Forensics, IT crime & law enforcement Privacy issues: LOPPSI, HADOPI, … Low-level hacking (console security & mobile devices) Risk management and ISO 27001 Dates January 20: CFP announced March 30: Submission deadline April 15: Notification sent to authors April 17: Program announcement June   16-17 :  Hack  In  Paris June ...

Immunity Debugger v1.82 latest version download ! " Immunity Debugger is a powerful new way to write exploits, analyze malware, and reverse engineer binary files. It builds on a solid user interface with function graphing, the industry's first heap analysis tool built specifically for heap creation, and a large and well supported Python API for easy extensibility. " This is the change log: Better handling of breakpoints. Fix thread suspend issues while handling breakpoints. Reintroduced the python shell. Updated Python to 2.7.1 Fixed python tracebacks to work again. Download the Immunity Debugger v1.82

A Microsoft lawsuit, unsealed earlier today, is responsible for causing government raids last Wednesday that lead to the downfall of the world's biggest spam network, Rustock. Microsoft's Digital Crimes Unit used information gained in its 2010 takedown of the Waledac botnet to work with the U.S. Marshals Service in locating and obtaining evidence from five hosting companies in seven U.S. cities. "DCU researchers watched a single Rustock-infected computer send 7,500 spam emails in just 45 minutes – a rate of 240,000 spam mails per day," said Richard Boscovich, Senior Attorney at the Microsoft Digital Crimes Unit, in a blog post. With approximately one million computers worldwide infected by Rustock, the botnet was able to send 240 billion spam messages in a single day. Symantec revealed in August last year that botnets were responsible for 95% of the Internet's spam, and that 41% of botnet spam came from the Rustock botnet. This means the dismantling of the Rustock ...

The Federal Bureau of Investigation (FBI) is reportedly investigating a hacker ring that is targeting phones and computers of celebrities and stealing nude photos and other personal items. The probe stems from nude photos of Vanessa Hudgens that were recently leaked online, reports the New York Daily News.  According to TMZ.com, the federal investigators met Hudgens Wednesday to discuss her latest nude photo scandal and believe she might be the latest victim of a notorious hacker crew that has targeted scores of celebrities, including Scarlett Johansson, Ali Larter, Busy Philipps and Miley Cyrus. A source told the website that one ringleader had fingerprints on every job and the primary motivation appeared to be the thrill and challenge - not money. The new round of Hudgens' photos surfaced on the Internet Monday after similar full-frontal nudes appeared online in 2007 and 2009. Hudgens, 22, is seen kissing 'Zoey 101' actress Alexa Nikolas in one of the new photos. ...

Top security firm RSA Security revealed on Thursday that it's been the victim of an "extremely sophisticated" hack. The company said in a note posted on its website that the intruders succeeded in stealing information related to the company's SecurID two-factor authentication products. SecurID adds an extra layer of protection to a login process by requiring users to enter a secret code number displayed on a keyfob, or in software, in addition to their password. The number is cryptographically generated and changes every 30 seconds. "While at this time we are confident that the information extracted does not enable a successful direct attack on any of our RSA SecurID customers," RSA wrote on its blog, "this information could potentially be used to reduce the effectiveness of a current two-factor authentication implementation as part of a broader attack. We are very actively communicating this situation to RSA customers and providing immediate steps for them to take to strengthen thei...

The PHP developers have  released  PHP 5.3.6, a maintenance update to the PHP interpreter. Among over 60 bug fixes are a number of fixes for security related problems. A format string vulnerability in the phar extension of PHP 5.3.5,  CVE-2011-1153 , may allow attackers to view memory, cause a denial of service or execute arbitrary code. There was also an integer overflow in the shmop_read() function which allowed for denial-of-service ( CVE-2011-1092 ). Other flaws included crashes with crafted tags in exif metadata and ziparchive with empty archives. Security has also been enhanced in the protocol parsing done by the fastcgi process manager (FPM SAPI). Some of the flaws reportedly affect all versions of PHP 5.3.x and earlier. The release also sees SQLite3 upgraded to version 3.7.4 and PCRE updated to version 8.11. The ability to connect to HTTPS sites through a proxy was also added as was options for debugging backtrace functions. A full list of changes is available in...