The Hacker News | #1 Trusted Source for Cybersecurity News — Index Page

Google's Android operating system may be open source, but the version of Android that runs on most phones, tablets, and other devices includes proprietary, closed-source components. Phone makers, including Samsung ships its Smartphones with a modified version of Android, with some pre-installed proprietary software and because of lack in independent code review of those closed-source apps, it is complex to authenticate its integrity and to identify the existence of backdoors . Paul Kocialkowski , the developers of the  Replicant OS  has uncovered a backdoor pre-installed on Samsung Galaxy devices and the Nexus S, that provides remote access to all the data in the device. Replicant OS is an open source operating system based on the Android mobile platform, which aims to replace all proprietary Android components with their free software counterparts. In a blog post , He explained that Samrtphones come with two separate processors, one for gen...

The massive data breaches in U.S retailers ' Target ' and ' Neiman Marcus ', in which financial credentials of more than 110 million and 1.1 million customers were compromised respectively, have put a spotlight on the need for more secure transactions. To tackle this issue, the two major payment card brands, MasterCard and Visa have announced the formation of a new cross-industry group that will focus on the security of the enhancing payment system to keep pace with the expectations of consumers, retailers and financial institutions in the United States. " The recent high-profile breaches have served as a catalyst for much needed collaboration between the retail and financial services industry on the issue of payment security," says Ryan McInerney, president of Visa Inc. "As we have long said, no one industry or technology can solve the issue of payment system fraud on its own. " The joint effort aims to advance the migration to EMV chip cards, also kno...

DDoS attacks are a growing issue facing by governments and businesses. In a recent attack, thousands of legitimate WordPress websites have been hijacked by hackers, without the need for them to be compromised. Instead, the attackers took advantage of an existing WordPress vulnerability ( CVE-2013-0235 ) - " Pingback Denial of Service possibility ". According to security company Sucuri , in a recent amplification attack more than 162,000 legitimate Wordpress sites were abused to launch a large-scale distributed denial-of-service (DDoS) attack . The attack exploited an issue with the XML-RPC (XML remote procedure call) of the WordPress, use to provide services such as Pingbacks, trackbacks, which allows anyone to initiate a request from WordPress to an arbitrary site. The functionality should be used to generate cross references between blogs, but it can easily be used for a single machine to originate millions of requests from multiple locations....

Adobe has released security updates to address important vulnerabilities in Adobe Flash Player 12.0.0.70 and earlier versions for Windows and Macintosh and Adobe Flash Player 11.2.202.341 and earlier versions for Linux. The new build intends to address following vulnerabilities in Adobe Flash Player: CVE-2014-0503 ,  reported by security researcher, ' Masato Kinugawa ', that lets   attackers bypass the same-origin policy. Attackers can exploit this issue to access resources from another origin in the context of another domain. This can facilitate cross-site request-forgery attacks. CVE-2014-0504 , reported by ' Jordan Milne ',   that could be used to read the contents of the clipboard(). The Clipboard can be used to store data, such as text and images, but flaw could allow hacker to stuff malware URLs onto your clipboard. Adobe Security Bulletin APSB14-08 tagged the updates with  Priority 2 , ' This update resolves vulnerabilitie...

Since mobile has become a basic need for every common as well as important figure now a days. So, every company is highly working to find more effective ways to protect sensitive data of their users and in the race, Vodafone lead the game. In collaboration with its security partner Giesecke & Devrient ( G&D ) which is an international leader in mobile security solutions, Vodafone is offering an end-to-end encryption for mobile communication based on the phone SIM card. Secure Data such as emails, documents, data carriers, and VPN connections will be signed and encrypted by the SIM in such a way that they are unreadable to unauthorized third parties assuring your security and privacy. SIM users have to encrypt the data by simply using a PIN and a digital signature, and the same is needed in order to decrypt the communication. " The solution uses the widespread S/MIME encryption program for email exchanges, and in the future, encryption via PGP will also be...

Facebook has several security measures to protect users' account, such as a user " access token " is granted to the Facebook application (like  Candy Crush Saga, Lexulous Word Game ), when the user authorizes it, it provides temporary and secure access to Facebook APIs. To make this possible, users have to ' allow or accep t' the application request so that an app can access your account information with the required permissions. The Access Token stores information about permissions that have been granted as well as information about when the token will expire and which app generated it. Approved Facebook apps can publish or delete content on your behalf using the access tokens, rather than your Facebook password. Access tokens are pretty sensitive, because anyone who knows the access token of a user can access the user's data and can perform any actions on behalf of the user, till the token is valid. In Past years, Many Security Researchers ...

Last week, The Foreign Intelligence Surveillance Court (FISA) ruled the National Security Agency (NSA) to do not keep Internet and phone metadata gathered through bulk surveillance programs longer than five years and destroy them. Judge Reggie Walton said, keeping records for more than 5 years " would further infringe on the privacy interests of United States persons whose telephone records were acquired in vast numbers and retained by the government ," Later, The Electronic Frontier Foundation, an Internet privacy and civil liberties group asked the Court to temporarily hold the destroy orders, saying the records may be used as an evidence in its lawsuits challenging the NSA surveillance . U.S. District Judge Jeffrey White, who is overseeing an invasion-of-privacy lawsuit against the National Security Agency (NSA), ruled to stop the destruction of millions of Telephone records collected by the National Security Agency's surveillance program and ruled to safeguard th...

The Whistleblower and Former National Security Agency (NSA) contractor Edward Snowden raised his voice and talked about citizen's privacy once again. Yes, Snowden, whose leaks last year triggered debate on the massive surveillance conducted by the Government worldwide. In an interview, speaking via Google Hangout at the South by Southwest Interactive conference, SXSW in Austin, Snowden said he has no regrets over his leaks about mass surveillance programs , despite now being unable to return to the US, where he faces a criminal indictment. He said, " Every society has benefited " from the disclosures. " Would I do this again? The answer is absolutely yes. Regardless of what happens to me, this is something we had a right to know. " Two BAD-Geeks:  Snowden criticized both Alexander and Michael Hayden, who were his predecessor as the NSA director, and the same two officials who mainly " harmed our Internet security and actually our national security ...

Pop Singer Justin Bieber's Twitter account hacked for around 15 minutes before it was corrected! The Twitter account with 50.2 Million Followers was compromised i.e. Twitter account with the second most Twitter followers. Spammers tweeted in Indonesian language from his hacked account with the links to a malicious twitter app named " ShootingStarPro ", and messages reading " Justin Bieber Cemberut? ", means - " Justin Bieber sullen? " It seems that the Justin's twitter account was hijacked by Indonesian hacker with a malicious twitter app, that further tweeted links to the a malicious website rumahfollowers[dot]tk   that hosted " ShootingStarPro " app, aimed to target his millions of followers in one shot. Justin's team quickly responded to the issue, deleted the bogus tweets and told fans " All good now. We handled it. ". He also warned his followers, " That link from earlier. Don't click it. Virus. Going to e...

We have seen a lot of Facebook malware and virus infections spreading through friends list, and this time a new clickjacking scam campaign is going viral on Facebook. Hackers spam Facebook timeline with a friend's picture and " See (Friend)'s naked video," or "(Friend Name's) Private Video. " The Picture appears to be uploaded by a friend and definitely, you might want to see some of your Facebook friends naked, But Beware!  If you get curious and click, you will be redirected to a malicious website reports that your Flash Player is not working properly and needs to be re-installed. But in actuality it will install a malware in your system and once approved, several disguised thing can happen to you. It further installs a malicious  browser extension to spread the scam and steal users' photos. " When the link is clicked, users are sent to a very realistic-looking mockup of a YouTube page, where the hackers will try to imme...

Last week, the Researchers at the German security company G Data Software have reported about the most complex and sophisticated rootkit  malware, Uroburos which is designed to steal data from secure facilities and has ability to take control of an infected machine, execute arbitrary commands and hide system activities. Recently, British cyber specialist BAE  has disclosed the parent Russian malware campaign dubbed as ' SNAKE ' that remained almost undetected for least eight years while penetrating highly secured systems. Uroburos rootkit was one of the components of this campaign. In a separate Investigation, Western intelligence officers have found another piece of spyware , infecting hundreds of government computers across Europe and the United States, known as ' Turla '. Researchers believed that  Turla  campaign is linked to a previously known campaign ' Red October ', a massive global cyber spying operation targeting diplomatic, military and nucle...

Smartphones are always ready to connect to the Internet and contains sensitive information such as Contacts, SMS, Photos, and GPS information and this sensitive information is always in danger of leakage. According to a report, Cyber criminals and state-sponsored hackers are developing 55,000 new malware variants, each and every day; and many of them try to elevate privileges for unfettered control of the user device. North Carolina State University Researchers have developed a new software, called Practical Root Exploit Containment ( PREC ) , with the sole purpose of detecting mobile malware that attempts to run Root exploits in Android devices. Root exploits take control of system administration functions of the operating system that gives the hacker an unrestricted control of user's Smartphone. That means, an application has not permission to read your messages or contacts or the GPS location, but after getting root access it will be able to steal any data from yo...