The Hacker News | #1 Trusted Source for Cybersecurity News — Index Page

Microsoft discloses vulnerabilities in Chrome and Opera Microsoft has issued two advisories on Chrome and Opera, detailing remote code execution and information disclosure vulnerabilities. The disclosure is the result of the Microsoft Vulnerability Research (MSVR) system going live, which is one of the core items within their Coordinated Vulnerability Disclosure (CVD) program. On Tuesday, Microsoft issued an MSRV Advisory related to use-after-free memory errors in Google's Chrome, which, if exploited, would have triggered a crash and allowed remote code execution in the browsers sandbox. "When attempting to parse specially crafted Web content, Google Chrome references memory that has been freed. An attacker could exploit the vulnerability to cause the browser to become unresponsive and/or exit unexpectedly, allowing an attacker to run arbitrary code within the Google Chrome Sandbox," the advisory explains. Google has addressed the issue in a patch delivered last September. Vers...

German software developer Ashampoo Hit by Data Breach ! German software developer Ashampoo has notified its customers about a data breach incident that resulted in the exposure of their names and email addresses. According to an announcement posted on the company's website, unidentified hackers broke through its security systems and gained unauthorized access to a server. "We discovered the break-in and interrupted it instantly. The security gap through which the hackers gained access was closed immediately," said Ashampoo's CEO Rolf Hilchner. "At the same time we reported this incident to the police. Further investigations are underway. Unfortunately, the traces of the well-concealed hackers currently disperse abroad," he added. Fortunately, the hackers did not obtain access to billing information as this data is not stored on the company's servers. In addition to its software development business, which includes anti-malware, firewall and ...

Siemens Assisted with Stuxnet 's Development, claimed by Iran ! A senior Iranian official accuses Siemens of willingly assisting the Stuxnet creators by providing the source code necessary for them to exploit its software. Iran's state news agency, the Islamic Republic News Service (IRNA), quotes Brigadier General Gholam Reza Jalali as saying the German engineering giant played a part in the development of the world's most sophisticated malware. "Siemens should explain why and how it provided the enemies with the information about the codes of the SCADA software and prepared the ground for a cyber attack against us," Jalali told IRNA. "It was a hostile action which could have inflicted serious damage on the country if it had not been dealt with in a timely manner," he added. Jalali's remark might be a result of a The New York Times report that pointed at Israel and the US as likely Stuxnet creators and mentioned that Siemens worked in 2008 ...

While phishing and ransomware dominate headlines, another critical risk quietly persists across most enterprises: exposed Git repositories leaking sensitive data. A risk that silently creates shadow access into core systems Git is the backbone of modern software development, hosting millions of repositories and serving thousands of organizations worldwide. Yet, amid the daily hustle of shipping code, developers may inadvertently leave behind API keys, tokens, or passwords in configuration files and code files, effectively handing attackers the keys to the kingdom. This isn't just about poor hygiene; it's a systemic and growing supply chain risk. As cyber threats become more sophisticated, so do compliance requirements. Security frameworks like NIS2, SOC2, and ISO 27001 now demand proof that software delivery pipelines are hardened and third-party risk is controlled. The message is clear: securing your Git repositories is no longer optional, it's essential. Below, we look at the ris...

DDOS attack on Change.org from China ! Change.org, an online petitioning platform, has come under an ongoing distributed denial of service (DDoS) attack originating from China after the site hosted a call urging Chinese authorities to release artist Ai Weiwei from custody. The attacks, which started late Sunday, have nearly brought down the site, according to Change.org founder Ben Rattray. DDoS attacks work by using hundreds or thousands of hacked computers to send traffic to a website, overwhelming it with data so it becomes inaccessible to normal users. Change.org said the current attack originates from an expanding group of computers primarily based in China, and has yet to stop. This is the first time the site has been hit with a DDoS attack. Change.org has been hosting a online petition calling for the release of Chinese artist Ai Weiwei, who is currently under arrest. The petition has attracted almost 100,000 people from 175 countries, making it one of Change.org'...

Verizon 2011 Data Breach Investigations Report Released ! Data loss through cyber attacks  decreased sharply in 2010, but the total number of breaches was higher than ever, according to the " Verizon 2011 Data Breach Investigations Report ." These findings continue to demonstrate that businesses and consumers must remain vigilant in implementing and maintaining security practices. The number of compromised records involved in data breaches investigated by Verizon and the U.S. Secret Service dropped from 144 million in 2009 to only 4 million in 2010, representing the lowest volume of data loss since the report's launch in 2008. Yet this year's report covers approximately 760 data breaches, the largest caseload to date. According to the report, the seeming contradiction between the low data loss and the high number of breaches likely stems from a significant decline in large-scale breaches, caused by a change in tactics by cybercrim...

BodgeIt Store  : Vulnerable Web Application For Penetration Testing ! Features Easy to install – just requires java and a servlet engine, e.g. Tomcat Self contained (no additional dependencies other than to 2 in the above line) Easy to change on the fly – all the functionality is implemented in JSPs, so no IDE required Cross platform Open source No separate db to install and configure – it uses an 'in memory' db that is automatically (re)initialized on start up There is also a 'scoring' page where you can see various hacking challenges and whether you have completed them or not. Install All you need to do is download and open the zip file, and then extract the war file into the webapps directory of your favorite servlet engine. Then point your browser at (for example) https://localhost:8080/bodgeit You can download BodgeIt Store here: Download Now Or read more here .

fileinfo-gui - Forensic tool for file information ! A GUI forensic tool for Ubuntu Linux designed to extract information from files. This is a beta version! Meta Data Information String ASCII and Unicode Hash MD5 and SHA1 Detect and Show PE32 Information Detect and Extract Thumbnail from JPEG file Install $ bash fileinfo --install Screenshot Right-click on the file -> Script -> FileInfo Main Menu (Classic) Meta Information String Information Hash MD5 Download Here

Lancaster 25,000 students and 2,500-plus employees personal info hacked ! Lancaster County Schools officials say computer hackers have gotten personal information on the system's 25,000 students and 2,500-plus employees. In a note posted on the school system's website and sent to students and staff, officials said hackers compromised the database sometime in March. The hackers gained access to computers, captured keystrokes, and obtained passwords. That gave them access to the database, which includes names, birthdates, Social Security numbers, addresses and phone numbers. The breach has been fixed, officials said. "We are doing anything we can to prevent this from happening again," Superintendent Gene Moore said. "And we have put new measures in place to better assure that our computers are protected from such attempts."

Two Hyundai Capital Services hackers arrested ! Two men who are believed to have hacked into the computer system of Hyundai Capital Services have been arrested. The pair, identified only by their surnames Heo and Yu are believed to be part of a group of five individuals who carried out the hack. The five were part of a gang which met online to carry out the hack. Three accomplices who are believed to be in the Philippines and Korean Police have asked Interpol for help in finding them. According to police, the two suspects met in December and plotted to hack into the company's database. They allegedly stole personal information of 420,000 people or 23 percent of Hyundai Capital's total customers and proved to be a deep embarrissment for the outfit.

Belnet Security Conference , 5 May 2011 in Brussels ! Security on the Internet is one of Belnet's highest priorities. Belnet after all has extensive expertise at its disposal in the area of Internet security. Moreover, with the expansion of its security services, Belnet wishes to raise awareness on the part of the user community with respect to security. Therefore Belnet organizes : What ? Belnet Security Conference When ? Thursday 5 may 2011 Where ? at Marivaux Hotel, Boulevard Adolphe Max 98, 1000 Brussels Accessmap Programme The presentations will address diverse security issues and trends. Among others practical safety tips, solutions and services will be treated. The presentations will be given in English Registrations Online registration is possible until noon on 3 Mei. Note: the number of participants is limited to 110. So register quickly here! Participation fee is : 36 EUR for customers and Belnet network users 98 EUR for others Read More & Regis...

5 Sites hacked by 133t Indian h4x0rs ! Hacked sites + Mirrors :  https://pastebin.com/y7W2X8fj

Atul Dwivedi (Indishell) hack into Kaizen Enterprises (Pak) Hacked Site :  https://www.kaizenenterprises.com.pk Mirror :  https://www.zone-h.com/mirror/id/13490446