The Hacker News | #1 Trusted Source for Cybersecurity News — Index Page

Kaspersky Lab publishes research resulting from the digital forensic analysis of the hard disk images obtained from the machines attacked by the Wiper - a destructive malware program attacking computer systems related to oil facilities in Western Asia. Security researchers from Kaspersky Lab have uncovered information suggesting a possible link between the mysterious malware that attacked Iranian oil ministry computers in April and the Stuxnet and Duqu cyber espionage threats. The malware wipes data from hard drives, placing high priority on those with a .pnf extension, which are the type of files Stuxnet and Duqu used, and has other behavioral similarities, according to Schouwenberg. It also deletes all traces of itself. As a result, researchers have not been able to get a sample, but they've reviewed mirror images left on hard drives. Kaspersky's researchers were not able to find the mysterious malware, which was given the name Wiper, because very little data from the aff...

Months after Hewlett-Packard originally announced the open-source version of WebOS , the beta version of the platform is on its way out the door. Friday's release includes two environments for developers.  The first is the desktop build, which is boasted to provide "the ideal development environment" for designing the webOS user experience with more features and integrating other open source technologies on the Ubuntu desktop. The second is the OpenEmbedded build for porting webOS to new devices. Equipped with an ARM emulator for running db8 and node.js services, HP cited that it included OpenEmbedded because of its "widespread community adoption" and cross-compiling support for embedded platforms. The news is getting announced in a blog post : “ It has taken a lot of hard work, long hours and weekend sacrifices by our engineering team to deliver on our promise and we have accomplished this goal ,” the developers write on the site devoid of any HP branding. T...

Oracle released an emergency patch on Thursday for previously unknown Java vulnerabilities that cybercriminals had targeted with popular exploit kits within hours after the bugs' existence became public, security researchers found yet another vulnerability that can be exploited to run arbitrary code on systems that have the runtime installed. Security researchers from Poland-based security firm Security Explorations claim to have discovered a vulnerability in the Java 7 security update released Thursday that can be exploited to escape the Java sandbox and execute arbitrary code on the underlying system. While so far the vulnerability has only been found being used against Windows, other platforms such as the Mac OS could potentially be targeted through the same exploit. Security Explorations sent a report about the vulnerability to Oracle on Friday together with a proof-of-concept exploit, Adam Gowdiak, the security company's founder and CEO said Friday via email. The compa...

The Air Force Life Cycle Management Center posted a broad agency announcement recently, calling on contractors to submit concept papers detailing technological demonstrations of 'cyberspace warfare operations' capabilities.  Air Force is seeking to obtain the abilities to 'destroy, deny, degrade, disrupt, deceive, corrupt, or usurp the adversaries' ability to use the cyberspace domain for his advantage' and capabilities that would allow them to intercept, identify, and locate sources of vulnerability for threat recognition, targeting, and planning, both immediately and for future operations. According to the document the issuing Program Office "is an organisation focused on the development and sustainment of Cyberspace Warfare Attack capabilites that directly support Cyberspace Warfare capabilities of the Air Force." Technologies that can map data and voice networks, provide access to the adversary's information, networks, systems or devices, manip...

Reports have surfaced that liquified natural gas (LNG) producer RasGas , based in the Persian Gulf nation of Qatar, has been struck by an unidentified virus, this time shutting down its website and email servers. The malware, however, did not affect the company’s operational computers that control the production and delivery of gas, an official of the Ras Laffan Liquefied Natural Gas company. The attack reportedly began Aug. 27. The RasGas website was still unavailable on Thursday, three days after the attack. For the second time in two weeks a virus outbreak has been reported at an energy company in that region. Earlier this week the Saudi Aramco oil company confirmed that its network was hit by a virus two weeks ago, shutting down 30,000 workstations. Neither company identified the virus, but in at least one of the cases it is believed to be malware known as "Shamoon." A joint venture between Qatar Petroleum and ExxonMobil, RasGas exports about 36.3 million tons of liq...

Oracle has released a new patch which kills off a vulnerability in Java 7 that was being exploited by malware developers. " Due to the high severity of these vulnerabilities, Oracle recommends that customers apply this Security Alert as soon as possible ," Eric Maurice, the company's director of software security assurance. The out-of-band Security Alert CVE-2012-4681 includes fixes for “three distinct but related vulnerabilities and one security-in-depth issue” affecting Java running within the browser. Users with vulnerable versions of Java installed can have malware silently planted on their systems just by browsing to a hacked or malicious website unknowingly.Java is a free programming language widely used to enable every day programs and website elements to function, including some games, apps and chat, as well as enterprise apps. The attacks using this vulnerability so far have been Windows-based, the exploit was demonstrated on other platforms supported by Java...

Russian anti-virus company Doctor Web reported about the first cross-platform backdoor to run under Linux and Mac OS X identified as " BackDoor.Wirenet.1 ". This malicious program designed to steals passwords entered by the user in Opera, Firefox, Chrome, and Chromium, and passwords stored by such applications as Thunderbird, SeaMonkey, and Pidgin. BackDoor.Wirenet.1 is the first-ever Trojan that can simultaneously work on these operating systems. BackDoor.Wirenet.1 is still under investigation. At launch BackDoor.Wirenet.1 creates a copy in the user's home directory. To interact with the command server located at 212.7.208.65, the malware uses a special encryption algorithm Advanced Encryption Standard (AES). BackDoor.

Yesterday someone anonymously posted on Slashdot that The Pirate Bay had launched a free VPN service called PrivitizeVPN ( http://freevpn.thepiratebay.se/ ) . But Just today team at torrentfreak confirms on behalf of team The Pirate Bay that its not  a Pirate Bay project. They’re just running it as an ad next to the regular download links. According to people close to PrivitizeVPN they are working on the connectivity issues. Till now according to PrivitizeVPN statics more than 45,091,927  users Downloads VPN client after the fake news that " The Pirate Bay team is going to be making the RIAA angry, with the launch of a new ad-supported VPN service "

FireEye's Malware Intelligence Lab is making the claim that there is a new zero day vulnerability in the wild that affects the latest version of Java.Researcher. Atif Mushtaq wrote on the company's blog that he spotted the initial exploit on a domain that pointed to an IP address in China. The vulnerability allows computers to be infected by simply visiting a specially crafted web page, and the malware served in the current attacks contacts a C&C server in Singapore. Researchers from heise Security have also created a PoC page using information that is publicly available. A separate post published on Monday by researchers Andre M. DiMino and Mila Parkour said the number of attacks, which appear to install the Poison Ivy Remote Access Trojan, were low. But they went on to note that the typical delay in issuing Java patches, combined with the circulation of exploit code, meant it was only a matter of time until the vulnerability is exploited more widely by other attackers. ...

TeamGhostShell  a team linked with the Activist group Anonymous, is claiming that they have hacked some major U.S. institutions including major banking institutions, accounts of politicians and has posted those details online. The dumps comprising of millions of accounts has been let loose on the web by the hacking collective. The motivation behind the hack, the group claims, is to protest against banks, politicians and the hackers who have been captured by law enforcement agencies. The group justifies its operation, Project HellFire, as a “ final form of protest this summer against the banks, politicians and for all the fallen hackers this year ”. Hacker also announced the public data of this phase is only the beginning, the group will continue to coordinate with organizations hacker raging world's most powerful Anonymous for two more planned later this year. According to initial information, the data may have been stolen from the organizations like CIS Services (not related t...

Anonymous Operation #OpColtan have announced another attack in the name of this operation and this time its on a Manufacturer and Supplierof Electronic Components AVX Corporation (www.avx.com). AVX It's a big firm wich produce ceramic and tantalum capacitors, connectors, thick and thin film capacitors, resistors and integrated passive components.  UN accused AVX, and many other firms to be interested in illegal coltan extraction and war in DRC. According to Hackers " Usually Coltan was stealed by war groups from Congo mines and carried out to the firms.Million of people lost their lives in Congo war, nature was destroied in order to dig coltan and a lots of gorillas were killed.Unfortunatelly UN decided to abandon the case and never punish the responsibles of the war an nature devastation ." " AVX and other involved firms published an ethical code in 2010; they claim that they don't get tantalium from war areas.NOW a new civil war is growing up in Congo and is...

Saudi Aramco, the world's biggest oil producer, has resumed operating its main internal computer networks after a virus infected about 30,000 of its workstations in mid-August. Immediately after the Aug. 15 attack, the company announced it had cut off its electronic systems from outside access to prevent further attacks. Saudi Aramco said the virus "originated from external sources" and that its investigation into the matter was ongoing. There was no mention of whether this was related to this month's Shamoon attacks. “ The disruption was suspected to be the result of a virus that had infected personal workstations without affecting the primary components of the network, ” Saudi Aramco said over Facebook . “ We would like to emphasize and assure our stakeholders, customers and partners that our core businesses of oil and gas exploration, production and distribution from the wellhead to the distribution network were unaffected and are functioning as reliably as ever...