The Hacker News | #1 Trusted Source for Cybersecurity News — Index Page

Oxford University launches Cyber Security Centre Cyber crime is not going away. As the world becomes ever more interconnected and dependent on networks, laptops and personal handheld devices, the opportunities are just too great. The personal information stored on such devices credit card information, drivers' licenses and Social Security numbers is at high risk and is often targeted by criminals because of the price it can bring on the black market. The Oxford Cyber Security Center is the new home to cutting-edge research designed to tackle the growing threats posed by cyber terrorism and cyber crime, and to safeguard the trustworthiness of electronically-stored information. In addition to being a springboard for new research, is an umbrella for current research activity worth in excess of £5m, supported close involvement of over 12 permanent academic staff, and in excess of 25 research staff, 18 doctoral students. Each year brings its own set of risks and chal...

Return of Lulzsec , Dump 170937 accounts from Military Dating Site Another Hacking group after Lulzsec , comes with name LulzsecReborn has posted names, usernames, passwords, and emails of 170,937 accounts on MilitarySingles.com on Pastebin as part of the group's Operation Digiturk. LulzSec was a major ticket item last year as the group hacked a number of high profile Web sites all in the name of the "lulz." After their so called "50 Day Cruise," the group broke up and went their separate ways.Hacker claim that, There are emails such as @us.army.mil ; @carney.navy.mil ; @greatlakes.cnet.navy.mil ; @microsoft.com ; etc.. in dump. In response to a query by the Office of Inadequate Security, ESingles, the parent company of MilitarySingles.com, said that there is " no actual evidence that MilitarySingles.com was hacked and it is possible that the Tweet from Operation Digiturk is simply a false claim. ". LulzSecReborn hack the site and added his deface page here , (as shown in abo...

Anonymous Attacker Package by Maxpain " Maxpain " Hacker and Security Developer, Releases two tools in an Package called " Anonymous Attacker Package ". First one is - Anonymous external attack , allows you to execute udp flood web attack, into websites, this tool was made as external of LOIC, the following package contains : #Anonymous External Attack - A console application made in C# that allows you to flood the websites with anonymous style , and sending 4096 packets each second. The program delays some seconds for each packet that it makes, so it flood effectively without lagging your own connections. Cool for DDoS attacks. (213kb file) #Anonymous DNS Extractor - Extracts the dns and ip servers of the following website, Developer included this program, cause in the target ip of AEA - anonymous external attack you need to use an IP. (128kb file) Both of programs are really light and console applications, by giving you the ultimate experience web attack. ...

SaaS Adoption is Skyrocketing, Resilience Hasn't Kept Pace SaaS platforms have revolutionized how businesses operate. They simplify collaboration, accelerate deployment, and reduce the overhead of managing infrastructure. But with their rise comes a subtle, dangerous assumption: that the convenience of SaaS extends to resilience. It doesn't. These platforms weren't built with full-scale data protection in mind . Most follow a shared responsibility model — wherein the provider ensures uptime and application security, but the data inside is your responsibility. In a world of hybrid architectures, global teams, and relentless cyber threats, that responsibility is harder than ever to manage. Modern organizations are being stretched across: Hybrid and multi-cloud environments with decentralized data sprawl Complex integration layers between IaaS, SaaS, and legacy systems Expanding regulatory pressure with steeper penalties for noncompliance Escalating ransomware threats and inside...

Free Configuration Check Tool by eEye Digital Security eEye Digital Security, the industry's leading innovator of threat management solutions, just released new research, " Working Toward Configuration Best Practices " . Findings verify that proper configuration and mitigations remain the most effective way to secure IT infrastructure. The research team at eEye also found that the leading mitigations it recommended in 2011 disabling WebDAV and Microsoft Office document converters - prevented even more vulnerabilities in 2011 than in 2010. In the case of turning off the Office document converters, the percentage increased from eight to 10 percent. Combined, the two tactics mitigate 20 percent of vulnerabilities. To put these relatively simple recommendations into action, IT administrators can download a new, free tool from the eEye researchers. It tests for some of the most highly recommended configuration updates and: • Offers a simple pass/fail and informational status ...

7 Ways to Improve Your Network's Web Security Admins looking to improve on their company's web security often turn to software solutions to help assess and automate their security tasks. Good web security software can make surfing the web safe and secure by protecting users from potential vulnerabilities in their operating systems or browsers, as well as helping them to avoid policy violations. The top web security software packages can help you to improve your network's web security in many ways. Here are seven of the major benefits web security software offers: 1. Automatic blocking of malicious content Compromised websites can lead to compromised workstations. Whether it's a malicious script or a media file, web security software can scan and block data before displaying it in a browser compromises a machine. 2. Scan downloads for malware Users frequently go to the Internet to download files, whether those are programs, music, or screensavers. Web security software can scan those...

Anonymous Deface page - " POPE is not welcome, out out!!!!! " Anonymous blocked access to two websites linked to the upcoming visit to Mexico by Pope Benedict XVI. Anonymous Hispano, the hackers succeeded in temporarily knocking the websites offline and defacing them with their own message: " Hacked system. The POPE is not welcome, out out!!!!! " In its profile on the social network Facebook, Anonymous Hispano said the Comfil site was " hacked for supporting Benedict XVI. " Benedict is scheduled to visit Mexico Friday through Monday, prior to a three-day trip to Cuba. In a video that was posted on YouTube, the hackers said that the pope's visit comes at the start of the campaign ahead of Mexico's July 1 presidential election, and that it seeks to benefit the ruling-party candidate. The Roman Catholic church, the video said, seeks " to keep the population shrouded in lies ." According to Anonymou s, the pope will not see either the poverty or the violence...

Hacktivism Breached 174 Million Records in 2011 According to the Verizon 2012 Data Breach Investigations Report released on Thursday, Hacktivists stole more data from large corporations than cybercriminals in 2011, according to a study of significant security incidents. The report surveyed 855 data breaches, where a combined 174 million digital records were purloined. Although a large number of records were compromised in 2011, the year was only the second-highest since Verizon began collecting breach information in 2004. " While a few 2011 breach victims estimated their losses to be in the hundreds of millions of dollars, most did not get near to that amount ," it said. " In fact, the large majority of them emerged relatively unscathed from their troubles. " In the report, Verizon, pointing to the " Arab Spring " protests, called 2011 " a year of civil and cultural uprising ."Certainly, hacktivists such as LulzSec did hog a good deal of the...

Cross-site scripting (XSS) Vulnerability reported on Paypal Paypal is affected by an XSS vulnerability where it fails to validate input on URL shown in above image. PayPal fixed the vulnerability shortly after being notified that its publicly posted. XSS, in general is a vulnerability that allows hackers to inject client side script on webpages and can modify how a user sees the webpage An attacker able to trick a user with a valid Paypal session into clicking a crafted version of the link below (wouldn't be hard, think a link on an eBay auction listing or a phishing e-mail for example) could hijack the user's session and initiate financial transactions on their behalf including money transfers. Alternatively this legitimate URL could be used to redirect the user to a spoofed PayPal web site designed to steal user credentials, which is a fairly common scam except in this case more effective as the user would see an actual PayPal URL to click on. [ Source ]

US Army's CECOM Data leaked by Hacker Hacker Black Jester recently published contract information from a Web site connected to the U.S. Army Communications and Electronics Command (CECOM). " 30 record sets that include names, user IDs, physical addresses, email addresses, telephone numbers, and clear-text passwords were published in a Pastebin document ," writes Softpedia . "' Old crappy server, but has good info inside it. The list is not complete due the lazy condition and msaccess db , enjoy!' the hacker wrote next to the data dump ," Kovacs writes. The Pastebin post doesn't contain the name of the site from where the data was leaked, but the hacker provided us with the IP address associated with it. That IP address led us to a Software Engineering Services site on which only "eligible users" may register.

Carberp Banking Trojan Scam - 8 Arrested in Russia 8 Men suspected of being involved in the Carberp phishing scam have been arrested in Russia. The men were arrested after a joint investigation by the Russian Ministry of Internal Affairs (MVD) and Federal Security Service (FSB). According to the MVD, the investigation found that two brothers were the ringleaders of the gang, and developed a plan to steal money from the accounts of online banking customers. The eight suspects allegedly stole more than 60 million Rubles ($2 million) from 90 victims using the Carberp Trojan. Russian security firm who assisted with the investigation, pegged the stolen loot at 130 million Rubles ($4.5 million). Police confiscated computers, bank cards, notary equipment, fake documentation, and more than 7 million Rubles ($240,000) in cash during the raid. The gang used the Carberp and RDP-door Trojans to snare victims. Carberp is a well-known Trojan that was recently seen on Facebook as part ...

Face to Face with Duqu malware Once again we discuss about Stuxnet, cyber weapons and of the malware that appears derivate from the dangerous virus. The international scientific community has defined a Stuxnet deadly weapon because been designed with a detailed analysis of final target environment supported by a meticulous intelligence work that for the first time in history has embraced the world of information technology. The agent was designed with the intent to strike the Iranian nuclear program and even more clear is who has always opposed such a program, U.S. and Israel first, and consider also the technology skill necessary to develope a weapon with the observed architecture is really high. Extremely important two factors af the event: 1. the choose of control systems as target of the malware. 2. the conception of the virus as an open project, a modular system for which it was designed a development platform used to assemble the deadly cyber weapons in relation to the final...

Vulnerability in Google Earth Software exposed by longrifle0x Ucha Gobejishvili, Security researcher also known as Longrifle0x , found another Interesting Security issue in one of the most famous software called,  Google Earth. He found a critical code execution vulnerability on google earth software client. For Proof of Concept , One can download any version of Google Earth, Then open "Click Placemark" , Put a malicious code there as one sample given below and Execute your code. Another past bug hunting by  Longrifle0x : 1.)  Cross Site Scripting (XSS) Vulnerability in Google 2.)  Skype Cross Site Vulnerabilities, user accounts can be Hijacked 3.) [POC] Buffer Overflow Vulnerability in GOM Media Player v. 2.1.37 and More..