The Hacker News | #1 Trusted Source for Cybersecurity News — Index Page

Instagram has recently suffered a possibly serious data breach with hackers gaining access to the phone numbers and email addresses for many "high-profile" users. The 700 million-user-strong, Facebook-owned photo sharing service has currently notified all of its verified users that an unknown hacker has accessed some of their profile data, including email addresses and phone numbers, using a bug in Instagram. The flaw actually resides in Instagram's application programming interface (API), which the service uses to communicate with other apps. Although the company did not reveal any details about the Instagram's API flaw, it assured its users that the bug has now been patched and its security team is further investigating the incident. "We recently discovered that one or more individuals obtained unlawful access to a number of high-profile Instagram users' contact information—specifically email address and phone number—by exploiting a bug in an Instagr...

OurMine is in headlines once again—this time for defacing WikiLeaks website. The notorious hacking group, OurMine, is known for breaching into high-profile figures and companies' social media accounts, including Facebook CEO Mark Zuckerberg , Twitter CEO Jack Dorsey , Google CEO Sundar Pichai , HBO , Game of Thrones and Sony's PlayStation Network (PSN). According to screenshots circulating on Twitter , the official website of WikiLeaks has reportedly been defaced by the OurMine hacking group, who left a message on the site, as shown above. WikiLeaks is a whistleblowing website that since March, has been revealing top CIA hacking secrets under Vault 7 , including the agency's ability to break into different mobile and desktop platforms , security camera live video streams , air-gap computers and many more. There is no indication of WikiLeaks servers and website been compromised, instead it seems their website has been redirected to a hacker-controlled server ...

Security researchers at ESET have discovered a new malware campaign targeting consulates, ministries and embassies worldwide to spy on governments and diplomats. Active since 2016, the malware campaign is leveraging a new backdoor, dubbed Gazer , and is believed to be carried out by Turla advanced persistent threat (APT) hacking group that's been previously linked to Russian intelligence. Gazer, written in C++, the backdoor delivers via spear phishing emails and hijacks targeted computers in two steps—first, the malware drops Skipper backdoor, which has previously been linked to Turla and then installs Gazer components. In previous cyber espionage campaigns, the Turla hacking group used Carbon and Kazuar backdoors as its second-stage malware, which also has many similarities with Gazer, according to research [ PDF ] published by ESET. Gazer receives encrypted commands from a remote command-and-control server and evades detection by using compromised, legitimate website...

The highest followers account on Instagram owned by Selena Gomez has recently been hacked with unknown hackers posting a bunch of nude photographs of her ex-boyfriend Justin Bieber on her account. The latest hack is not part of the ongoing Fappening events affecting a majority of celebrities by targeting their iCloud accounts, rather in the case of Selena, some hacker managed to breach her Instagram account and posted Bieber's photos. Bieber's three full-frontal shots of naked photos were visible to Selena's 125 million Instagram followers for a short duration of time, after which her account was swiftly taken down Monday night. A post from Selena's official Instagram account went up Monday showing 3 pics of Bieber with a caption that read: "LOOK AT THIS N***A LIL SHRIMPY." Selena's team has since re-secured her Instagram account, which was back online minutes after it was taken down, with the photos of Bieber deleted. The Bieber nude images...

A massive database of 630 million email addresses used by a spambot to send large amounts of spam to has been published online in what appears to be one of the biggest data dumps of its kind. A French security researcher, who uses online handle Benkow , has spotted the database on an "open and accessible" server containing a vast amount of email addresses, along with millions of SMTP credentials from around the world. The database is hosted on the spambot server in Netherlands and is stored without any access controls, making the data publicly available for anyone to access without requiring any password. According to a blog post published by Benkow, the spambot server, dubbed "Onliner Spambot," has been used to send out spams and spread a banking trojan called Ursnif to users since at least 2016. Ursnif Banking Trojan is capable of stealing banking information from target computers including credit card data, and other personal information like login ...

If you're an engineer and use LabVIEW software to design machines or industrial equipments, you should be very suspicious while opening any VI (virtual instrument) file. LabVIEW, developed by American company National Instruments, is a visual programming language and powerful system-design tool that is being used worldwide in hundreds of fields and provides engineers with a simple environment to build measurement or control systems Security researchers from Cisco's Talos Security Intelligence have discovered a critical vulnerability in LabVIEW software that could allow attackers to execute malicious code on a target computer, giving them full control of the system. Identified as CVE-2017-2779 , the code execution vulnerability could be triggered by opening a specially crafted VI file, a proprietary file format used by LabVIEW. The vulnerability originates because of memory corruption issue in the RSRC segment parsing functionality of LabVIEW. Modulating the values ...

If you reside in China, your Internet life within the borders will soon be even more challenging. Last Friday, China's top Internet regulator announced a new set of rules that would force citizens to post comments using their real-world identities on Internet forums and other web platforms. Yes, you heard that right. Anonymity is about to die in the country. The Cyberspace Administration of China (CAC) will start officially enforcing the new rules starting from October 1, 2017, requiring websites operators and service providers of online forums to request and verify real names and other personal information from users when they register and must immediately report illegal content to the authorities. According to the CAC, the following content would be considered unlawful and forbidden from being published online: Opposing the basic principles as defined in the Constitution Endangering national security Damaging nation's honor and interests Inciting national ha...

Do you believe that just because you have downloaded an app from the official app store, you're safe from malware? Think twice before believing it. A team of security researchers from several security firms have uncovered a new, widespread botnet that consists of tens of thousands of hacked Android smartphones. Dubbed WireX, detected as "Android Clicker," the botnet network primarily includes infected Android devices running one of the hundreds of malicious apps installed from Google Play Store and is designed to conduct massive application layer DDoS attacks. Researchers from different Internet technology and security companies—which includes Akamai, CloudFlare , Flashpoint, Google, Oracle Dyn, RiskIQ, Team Cymru—spotted a series of cyber attacks earlier this month, and they collaborated to combat it. Although Android malware campaigns are quite common these days and this newly discovered campaign is also not that much sophisticated, I am quite impressed wit...

Since most of us rely upon the Internet for day-to-day activities today, hacking and spying have become a prime concern, and so have online security and privacy. The Internet has become a digital universe with websites collecting your sensitive information and selling them to advertisers, hackers looking for ways to steal your data from the ill-equipped networks, websites, and PCs, and government conducting mass surveillance—every model has shifted to data collection. So, what's the solution and how can you protect your privacy, defend against government surveillance and prevent malware attacks? Virtual Private Network —Yes, one of the most efficient solutions to maximize your privacy is to use a secure VPN service. VPN serves as an encrypted tunnel between your computer and destinations you visit on the internet to secure your Internet traffic and protects you from bad guys getting into your network to steal your sensitive data. When choosing a VPN, Private Internet A...

Are you also one of those 18 Million users using SARAHAH? You should beware of this app because the anonymous feedback application may not be as private as it really sounds. Sarahah is a newly launched app that has become one of the hottest iPhone and Android apps in the past couple of weeks, allowing its users to sign up to receive anonymised, candid messages from other Sarahah users. However, it turns out that the app silently uploads users' phone contacts to the company's servers for no good reason, spotted by security analyst Zachary Julian. When an Android or iOS user downloads and installs the app for the first time, the app immediately harvests and uploads all phone numbers and email addresses from the user's address book, according to The Intercept . While an app requesting access to the user's phonebook is quite common if the app provides any feature that works with contacts, no such functionality in Sarahah is available right now. "The pri...

"Ransomware" threat is on the rise, and cyber criminals are making millions of dollars by victimizing as many people as they can—with WannaCry , NotPetya and LeakerLocker being the ransomware threats that made headlines recently. What's BAD? Hacker even started selling ransomware-as-a-service (RaaS) kits in an attempt to spread this creepy threat more easily, so that even a non-tech user can create their own ransomware and distribute the threat to a wider audience. The WORSE —You could see a massive increase in the number of ransomware campaigns during the next several months—thanks to new Android apps available for anyone to download that let them quickly and easily create Android ransomware with their own devices. Security researchers at Antivirus firm Symantec have spotted some Android apps available on hacking forums and through advertisements on a social networking messaging service popular in China, which let any wannabe hacker download and use Trojan ...

The FBI has arrested a Chinese citizen for allegedly distributing malware used in the 2015 massive OPM breach that resulted in the theft of personal details of more than 25 Million U.S. federal employees, including 5.6 Million federal officials' fingerprints . Yu Pingan , identified by the agency as the pseudonym "GoldSun," was arrested at Los Angeles international airport on Wednesday when he was arrived in the United States to attend a conference, CNN reported . The 36-year-old Chinese national is said to face charges in connection with the Sakula malware , which was not only used to breach the US Office of Personnel Management (OPM) but also breached Anthem health insurance firm in 2015. The Anthem breach resulted in the theft of personal medical records of around 80 million current and former customers of the company. Sakula is a sophisticated remote access Trojan (RAT) that was known to be developed by Deep Panda , a China-based advanced persistent threa...