The Hacker News | #1 Trusted Source for Cybersecurity News — Index Page

An 18-year old Miami University student is facing charges for allegedly breaching the school's computer system to change grades for himself and four other students. Jose Bautista appeared before a judge Friday after he was arrested Thursday by the Miami School Board Police after the principal of Dr. Michael M. Krop Senior High School turned him in, after the student reportedly gave him a written confession. The principal claims he obtained a written confession from the student. " It's not fair to the people that really try ," said Mayan Dehry , a student at Bautista's school. " Like, I know a lot of kids are in AP classes, and they try really hard to get the grades that they get. I don't know, if you're just going to be lazy and then change your grades, that's not what learning is about. " A fellow student Brett Curtis said Bautista's actions are not representative of the majority of his peers. " We have almost 3,000...

After Heartbleed bug , a security flaw in widely used open-source software OpenSSL that puts countless websites at risk, another vulnerability has been found in popular authentication software OpenID and authorization software OAuth. Wang Jing , a Chinese mathematics Ph.D student at the Nanyang Technological University in Singapore, found that the OAuth and OpenID open source login tools are vulnerable to the " Covert Redirect " exploit. The login tools ' OAuth ' and 'OpenID' protocols are the commonly used open standard for authorization. OAuth designed as a way for users to sign in or sign up for other services using an existing identity of a site such as Google, Facebook, Microsoft or Twitter, whereas OpenID is a decentralized authentication system for the Internet that allows users to log in at websites across the internet with same digital identity. The Covert Redirect vulnerability could affect those who use 'OAuth' and 'OpenID' protocols to 'login' to the websites ...

Microsoft had publicized widely its plans to stop supporting oldest and widely used Operating system, Windows XP after 8th April this year, which means Microsoft would no longer issue security patches for XP. A few days back, we reported about a new critical Zero-day vulnerability in all versions of Microsoft's browser Internet Explorer, starting with IE version 6 and including IE version 11. According to the advisory (CVE-2014-1776), All versions of Internet Explorer are vulnerable to Remote Code Execution flaw, which resides ' in the way that Internet Explorer accesses an object in memory that has been deleted or has not been properly allocated ,' Microsoft confirmed . An attacker who successfully exploited this vulnerability could gain the same user rights as the current user. FIRST PATCH FOR WINDOWS XP, EVEN AFTER EXPIRATION DATE Internet Explorer vulnerability poses a special concern for people still using Windows XP , but can Microsoft really ignore inno...

An alleged member of the famous amorphous Hacktivist group Anonymous is now facing a total of 44 charges after the filing of the latest superseding Indictment of cyber assaults charges against him with the collective to hack Computer systems of a County Government, a school district and a Newspaper organization in Texas, federal investigators announced on Tuesday. 27-year-old Fidel Salinas of Donna, Texas, charged with several counts of cyber stalking, attempted computer hacking and with intent to harass and intimidate a female victim, making it altogether 44 counts of cyber assaults that could lead him up to 440 years in Jail. Salinas intentionally tried to hack into the computer system of Hidalgo County practically two years earlier, for which he was charged with one count of violating the Computer Fraud and Abuse Act after a grand jury in the United States District Court for the Southern District of Texas found him guilty, last October. It looked like, Salinas wou...

There is no question that Mobile devices have become a staple in everyday living around the world. But have you ever asked yourself, How Secure are the Android, iPhone or any other Smart devices? It is really important for us to think about the Security and Privacy of our Data stored in Smartphones. In June 2010, Apple introduced ' Data protection ' feature in iOS 4.0 devices that offer hardware encryption for  all the data stored on the devices. " Data protection enhances the built-in hardware encryption by protecting the hardware encryption keys with your passcode. This provides an additional layer of protection for your email messages attachments , and third-party applications ." Apple claimed  in an old announcement. But unexpectedly, In last few updates Apple has silently removed the email attachment encryption from  data protection mechanisms. Noticed by Security Researcher -  Andreas Kurtz , claims that  since at...

We're comfortable in sharing information with our Facebook friends, but it is quite sneaky for Facebook users to offer their Identities and credentials when logging in to third-party apps , they don't trust. To deal with this issue, the social network giant has plans to improve the way users login to the third party apps with more privacy controls on the web as well as mobile devices. ANONYMOUS LOGIN At Facebook's F8 developer conference in San Francisco on Wednesday, Keynote speaker - Chief Executive Mark Zuckerberg announced the new Facebook's login tool, " Anonymous Login " that would let users sign into apps and websites anonymously without sharing their personal information-Biggest news for Facebook users. " Today, we want to do more to put control and power back into people's hands, " Zuckerberg said at the conference. " Up until now, your friends have been able to share your data via using apps. Now we're changing this, so every...

When it comes to Digital Forensics, Penetration and Security testing, we mostly relies on Kali Linux distribution (also known as Backtrack), which is designed for security professionals and packed with more than 300 security testing tools. But Today, Mailing List sub-domain of Kali Linux get hacked and defaced by Libyan hacking group known as ' The GreaT TeAm (TGT) '. A mailing list is simply a list of email addresses to which the same information is being sent. A discussion list is used to allow a group of people to discuss topics amongst themselves, with everyone able to send mail to the list and have it distributed to everyone in the group. Mailing lists have become a popular way for Internet users to keep up with topics they're interested in. At the time of writing, The Homepage of Kali Linux mailing list domain was displaying two lists, i.e. Kali with description "Hacked By The GreaT TeAm -TGT" Kali-Dev with description "Libyan Hackers" S...

The massive data breaches in U.S largest retailers ' Target ', marked the largest card heists in the U.S. history in which financial credentials of more than 110 million customers were compromised, have forced the retailer to take step towards more secure transactions. The retailer company on Tuesday said it is implementing chip-and-PIN payment card systems for its stores and will be soon working with the MasterCard to replace all of its REDcard customer cards to chip-and-PIN secured cards. The transition to chip-and-Pin-enabled REDcards is set to begin in early 2015. " The new payment terminals will be in all 1,797 U.S. stores by this September, six months ahead of schedule. In addition, by early next year, Target will enable all REDcards with chip-and-PIN technology and begin accepting payments from all chip-enabled cards in its stores, " the company said. The chip-and-PIN system, also known as the EMV standard. Instead of using a magnetic stripe to store fina...

The founder of 4chan , Christopher Poole , aka "moot" has confirmed few hours ago, in a blog post that the popular image-based bulletin board was hacked. The attacker gained access to the administrative functions and successfully hacked into one of 4chan's database by exploiting a website's software vulnerability last week. The motive behind the hack was to expose the posting habits of a specific user the attacker didn't like, moot wrote. It is believed that the software vulnerability allowed the attacker to hack into only the image-board moderation panels, and some tables in the 4chan back-end database . According to the blog post, the way hacker extracted the information from its database, 4chan knows the " detailed logs of what was accessed", which indicate that the "primarily moderator account names " and their "credentials" were targeted and compromised by the hacker. " Due to the way the intruder extracted information from the database, we have detailed logs of wh...

If you are a user of the American On-Line (AOL) mail service then you are advised to change your password as soon as possible. AOL Inc. on Monday confirmed the company suffered a massive data breach that may have affected a "significant number" of email accounts. The company has issued a warning to users that their personal information including email addresses, postal addresses, address books, encrypted passwords and the encrypted answers to security question-answers, has been stolen by attackers, the New York-based company said Monday. " The ongoing investigation of this serious criminal activity is our top priority, " AOL said in a blog post . " We are working closely with federal authorities to pursue this investigation to its resolution. Our security team has put enhanced protective measures in place, and we urge our users to take proactive steps to help ensure the security of their accounts ." AOL said it began investigating the ...

An application should always encrypt users' sensitive data, either it is local or stored on company servers, but still many popular services failed to provide fully secured solutions to their users. Cristian Dinu (DrOptix) and Dragoş Gaftoneanu , Romanian programmers at Hackyard Security Group , a private community dedicated to IT security research approaches ' The Hacker News ' editorial and claimed that the Microsoft owned most popular free voice calling service Skype leaves its local database unencrypted, that puts users' sensitive information at risk. All Skype-to-Skype voice, video, file transfers and instant messages are encrypted. Though, Skype's local database is also supposed to be encrypted because it is sensitive enough, but  Dragoş  found that Skype leaves users' full name, birthday, phone numbers, country, city and even full chat conversations unencrypted on the systems' hard drive in a known location without any encryption or password....

Microsoft confirmed a new Zero Day critical vulnerability in its browser Internet Explorer . Flaw affects all versions of Internet Explorer, starting with IE version 6 and including IE version 11. In a Security Advisory ( 2963983 ) released yesterday, Microsoft acknowledges a zero-day Internet Explorer vulnerability ( CVE-2014-177 6) is being used in targeted attacks by APT groups, but the currently active attack campaigns are targeting IE9, IE10 and IE11. INTERNET EXPLORER 0-DAY VULNERABILITY (CVE-2014-1776) According to Advisory, Internet Explorer is vulnerable to Remote Code Execution, which resides ' in the way that Internet Explorer accesses an object in memory that has been deleted or has not been properly allocated. ' Microsoft said. Microsoft Investigation team is currently working with FireEye Security experts, and dubbed the ongoing targeted campaign as " Operation Clandestine Fox ". In a blogpost , FireEye explained that an attacker c...