The Hacker News | #1 Trusted Source for Cybersecurity News — Index Page

Core Security Technologies victim of latest Hack Core Security Technologies itself become the latest victim of hack by sncope hacker. Hacker deface the websites, Mirror of hack can be seen here . Core Security offers the first and only real-world approach to security testing and measurement, but what if they got hacked ? that really terrific sometime...  More Domains of Core Security Hacked by him:

FBI Arrests Suspected LulzSec and Anonymous Hackers Search warrants were also being executed in New Jersey, Minnesota and Montana. The FBI  arrested two alleged members of the hacking collectives LulzSec and Anonymous on Thursday morning in San Francisco and Phoenix, According to Fox news. The suspected hacker arrested in California is homeless and alleged to have been involved in the hacking of Santa Cruz County government websites. The person arrested in Arizona is a student at a technical university and allegedly participated in the widely publicized hack against Sony. Both groups have been targeted by the FBI and international law enforcement agencies in recent months. Meanwhile, the FBI arrested an alleged Anonymous member in San Francisco. The man, who is reported to be homeless, is said to have been involved in internet attacks against Santa Cruz County government websites.Just because a man is homeless, of course, doesn't mean that he can't get an internet ...

BruCON Agnitio workshop Slides and Video Demonstration - Download Workshop by David Rook ( Security Ninja ) at BruCON 2011 in Belgium. You can Download Slide from here . Required for the Agnitio hands on demos: A 32bit Windows Operating System (XP or 7 preferably – VM will be fine) .NET framework 3.5 installed Agnitio v2.0 installed Download the Pandemobium Android and iOS source code Download the selected vulnerable open source application Optional In addition to the list above the following things are optional depending on how hands on you want to be: Internet connection to download an application from the Android market place Eclipse IDE installed Android SDK installed Android Debug Bridge (adb) installed, this should be installed as part of the SDK install An AVD configured with the Android market place app installed (instructions here) I think you can also use a rooted Android device if you don't want to use the emulator Workshop format A quick look at stati...

Is Managing Customer Logins and Data Giving You Headaches? You're Not Alone! Today, we all expect super-fast, secure, and personalized online experiences. But let's be honest, we're also more careful about how our data is used. If something feels off, trust can vanish in an instant. Add to that the lightning-fast changes AI is bringing to everything from how we log in to spotting online fraud, and it's a whole new ball game! If you're dealing with logins, data privacy, bringing new users on board, or building digital trust, this webinar is for you . Join us for " Navigating Customer Identity in the AI Era ," where we'll dive into the Auth0 2025 Customer Identity Trends Report . We'll show you what's working, what's not, and how to tweak your strategy for the year ahead. In just one session, you'll get practical answers to real-world challenges like: How AI is changing what users expect – and where they're starting to push ba...

Let's Play a Game of Cyber Security at  CSAW CTF 2011   Ready for a little game of capture the flag? What if you weren't running around a field like a crazy person trying to grab a flag out of someone's belt, but instead were navigating around a network overcoming technical challenges to find markers that you are awarded points for once submitted? Then CSAW CTF 2011 is where it's at. CSAW CTF 2011 is hosting the qualifying round from Friday September 23, 2011 to Sunday September 25, 2011. The competition will begin at 8PM that Friday night, and is used to determine who will proceed on to the finals taking place in New York November 10-11 at NYU-Poly.   The event is centered on assessing application security abilities. For the qualification round there is no limit to the number of team members you can have, but if you move on to the final round your team will be limited to four players. If you attend the event you'll have the chance to rub elbows with anyon...

Lilith: Perl script to audit web applications Lilith tool analyses webpages and looks for htmltags , which often refer to dynamic pages that might be subject to SQL injection or other flaws.Lilith basic function is to spider and analyses pages, following hyperlinks, injecting special characters that have a special meaning to any underlying platform. As most of us know web applications scanner can never perform a full 100% correct audit. A manual re-check eliminates most of the false positve. Features and changes made in lilith got rid of many many false positives (that's good) when SQL error is found, it now goes onto next var improved (i hope) scanning engine (anti) coldfusion support better cookie handling and cookie tampering omitted perl HTML::Form limitation better verbose output extensive logging detects directory indexing recursive URL dissection cleaned up this pasta code Download Lilith

Win Free Copies of BackTrack 5 Wireless Penetration Testing Guide with The Hacker News Fellow hackers would be very pleased to know that to celebrate the release of their new book- BackTrack 5 Wireless Penetration Testing Beginner's Guide , Packt Publishing is giving away 2 copies of the book to The Hacker News readers. Keep reading to find out how you can be one of the Lucky Winner. Here is a quick overview of BackTrack 5 Wireless Penetration Testing Beginner's Guide · Learn Wireless Penetration Testing with the most recent version of Backtrack · The first and only book that covers wireless testing with BackTrack · Concepts explained with step-by-step practical sessions and rich illustrations · Written by Vivek Ramachandran ¬ world renowned security research and evangelist, and discoverer of the wireless "Caffe Latte Attack" Read More How To Win Sound like something you might be interested in? All you need to do is head on over to the bo...

50000 WordPress Sites infected with spam The attack consists of contacting the domain wplinksforwork.com to get a list of links to be displayed on the compromised sites. However, that domain has been down for the last few days and all the sites compromised. These sites supposed to be compromised. Most of the hacked sites had outdated versions of WordPress installed. Infected sites have following message at Footer : Warning: file_get_contents(https://wplinksforwork.com/56132.. 47509328/p.php?host=… failed to open stream: php_network_getaddresses: getaddrinfo failed: Name or service not known in ..

Kazakhstan calls for global cyber security treaty to deter hackers at United Nations Today's security professionals - whether they are black hats, white hats or something in between - all have one thing in common: The knowledge of their craft probably did not come from a book or a classroom. Today's security skills - both good and bad - we learn online, in the unstructured jungle of the Internet. President Nursultan Nazarbayev told the debate's opening session – held at United Nations Headquarters in New York – that it was worrying that "not a single international convention or multilateral treaty governs information processes. " Is it not the reason why, in practical terms, most hacker attacks on banks, businesses, government institutions, [the] military and even nuclear facilities have been carried out with impunity? " he asked. Mr. Nazarbayev stressed the need for what he called " an international legal framework of the global information space ." He said suc...

More Android vulnerabilities exposed [Video Demonstration] It's been more than a month since researchers reported two serious security vulnerabilities in Android, but so far there's no indication when they will be purged from the Google-spawned operating system that's the world's most popular smartphone platform. Oberheide and Lanier are set to teach a two-day mobile security training course at SOURCE Barcelona this November where they will presumably refer to this and other Android vulnerabilities. Let's hope, for the sake of Android's reputation, that these things are resolved much sooner. The first vulnerability is known as a " Permission escalation vulnerability ", and allows attackers to install additional " arbitrary applications with arbitrary permissions ", without first asking the user if they want to permit such actions. This would allow attackers to access call records, texts, web browsing history and media stored on the device. The second bug...

Visual DuxDebugger Debugger - Disassembler for Windows 64-bit Main features Fully support 64-bit native processes Fully support 64-bit .NET processes Full code analysis Full memory analysis Code edition Memory edition Module export formats (EXE/DLL/CSV) Debug multiple processes Debug multiple child processes Minimum Requirements O.S: Windows 7 64-bit / Windows Server 2008 R2 Processor: Pentium 4 3.0 GHz Recommended Requirements O.S: Windows 7 64-bit / Windows Server 2008 R2 Processor: Dual Core 2.5 GHz Display: 1920 x 1080 Download

Vulnerability in its Identity Services Engine of Cisco Cisco is warning users of a critical vulnerability ( CVE-2011-3290 ) in its Identity Services Engine (ISE). In its security advisory, the company says that the underlying database used by ISE, its identity and access control policy platform, contains three sets of default credentials that could be exploited by a remote attacker without any end-user interaction. Using these credentials, an attacker could modify the configuration and settings, or even gain complete administrative control of a device. All hardware appliance and software-only versions of Cisco ISE prior to 1.0.4.MR2 are affected.The company says that it will release a free update to the software to address the vulnerability on 30 September 2011; no temporary workaround is available. Once released, the updates will be available to download from the Cisco Software Center. [ Source ]

Aldi Bot - Buy a Botnet just in 10 Euros Researchers of German security firm G Data have discovered that a bot builder dubbed " Aldi Bot " is currently being offered for that much on underground forums. The Aldi Bot Builder appears to be based on the ZeuS source code. The malware has nothing to do with the discount supermarket chain and it is not clear why its author chose to name the bot after Aldi – it is thought it may relate to the bot's discount pricing. Company says " We've encountered a bot sale, which, in case it finds followers, can cause a massive glut of malware all over. The so-called "Aldi Bot" first appeared in late August and has been sold for the initial price of €10! Parts of the bot's code oddly look like ZeuS code… " The Aldi Bot can read (saved) passwords from the Firefox web browser, Pidgin IM client and JDownloader download tool, and send them to a command and control server which is included in the €10 price tag. The Aldi Bot can als...

Bank of Melbourne Twitter Account Hacked Last week, the Twitter account of the Bank of Melbourne was hacked and used to send direct messages containing phishing links to its followers. In a tweet , the bank said that: ATTN: Unauthorised DMs sent bw 4-5pm today, do not click link. No customer/personal data compromised. Apologies for the inconvenience. A recently relaunched subsidiary of Westpac, the Australian bank engages heavily with its customers through its @BankofMelb Twitter account. However, the security of the account proved not to be up to scratch when hackers managed to gain access and used the account to send direct messages containing phishing links.The hacking of corporate Twitter accounts is nothing new, neither are phoney messages claiming to come from a bank. What makes this case rather unique - and worrying - is that the account itself is genuine, thus significantly adding to the credibility of the links. Dancho Danchev believes that this is not the act of an am...

John the Ripper 1.7.8-jumbo-7 Released Change Log : * Support for encrypted pkzip archives has been added, testing millions of candidate passwords per second. (JimF) (This is in addition to WinZip/AES archives, support for which was added in prior -jumbo updates.) * Support for Mac OS X 10.7 Lion salted SHA-512 hashes has been added (enabled when building against OpenSSL 0.9.8+ only), with optional OpenMP parallelization. (Solar) * Optional OpenMP parallelization has been added for salted SHA-1 hashes used by Mac OS X 10.4 to 10.6. (Solar) * PoC support for DES-based 10-character tripcodes has been added (does not use the bitslice DES implementation yet, hence is slow). (Solar) * The DIGEST-MD5 authentication cracker has been revised to be usable without requiring source code customizations. (magnum) * Highly experimental support for dynamically loaded plugins (adding new formats) has been added (currently only enabled on Linux). (Davi...

Nmap 5.61 TEST1 Released This Nmap 5.61TEST1 is an informal test release with all of the latest features from the SVN. Nmap ("Network Mapper") is a free and open source utility for network exploration or security auditing. Many systems and network administrators also find it useful for tasks such as network inventory, managing service upgrade schedules, and monitoring host or service uptime. Nmap uses raw IP packets in novel ways to determine what hosts are available on the network, what services (application name and version) those hosts are offering, what operating systems (and OS versions) they are running, what type of packet filters/firewalls are in use, and dozens of other characteristics. It was designed to rapidly scan large networks, but works fine against single hosts. Nmap runs on all major computer operating systems, and official binary packages are avalable for Linux, Windows, and Mac OS X. In addition to the classic command-line Nmap executable, the Nmap suite includes a...

Radware's Attack Mitigation System Delivers the First Fully Integrated Solution to Fight Cyber Attacks in Real Time The solution blocks the new breed of sophisticated attacks that target Multiple layers of the IT infrastructure .  Today's point security tools for IT infrastructures are not enough to protect against the new wave of sophisticated cyber attacks. That's why  Radware  (NASDAQ: RDWR), a leading provider of  application delivery  and  application security  solutions for virtual and cloud data centers, today announced Radware Attack Mitigation System (AMS), the industry's first fully integrated IT security strategy and portfolio that protects the application infrastructure in real time against network and application downtime, application vulnerability exploitation, malware spread, information theft, Web service attacks and Web defacement. Additional Resources   ·            ...

iPhone  Skype  XSS Vulnerability Lets Hackers Steal Phonebook [Video] A bug in the latest version of Skype for iPhone and iPod touch makes its users vulnerable to having their address book stolen just by viewing a specially crafted message, says AppSec Consulting security researcher Phil Purviance. The problem is made more exploitable by the way Skype uses the embeddable WebKit browser; Skype developers have set the URI scheme for the embedded browser to "file://". This error allows an attacker to access the file system and read any file that the app would be allowed to read by the iOS application sandbox. One file that every iOS application has access to is the user's SQLlite AddressBook database. In a demonstration of the bugs, Phil Purviance, AppSec Consulting security researcher, showed how it was possible to extract the iPhone address book using the vulnerabilities. Skype is aware of the issue and is working on a fix. "We are working hard to fix this reported i...

Chris Hoff, HacKid.org Leads UNITED Security Summit Award Winners Awards Recognize Outstanding Contributions to Propel the Information Security Industry Forward to Meet Future Challenges San Francisco, CA at the UNITED Security Summit – September 20, 2011 –  The first annual  UNITED Security Summit  included an awards ceremony at the official event party, held at Vessel, San Francisco last night. The UNITED Security Summit Awards focus on recognizing the contributions of individuals and organizations that are propelling the information security industry forward, building the level of preparedness in the face of the changing threat landscape.  Winners at the ceremony were recognized specifically for innovation, collaboration, investment in the future or in the industry in general, and leadership. "As a co-sponsor of the UNITED Security Summit awards and participant in the judging process, it's exciting to see how innovative and collaborative companies in the secu...

The Europe Championships of the Global CyberLympics has just concluded! It is now time to crown new CHAMPIONS for the Middle East & India Regional ! About the Global CyberLympics: The Global CyberLympics ( www.cyberlympics.org ) is the world's first international team ethical hacking championships, and will be held from September onwards across six continents. It is endorsed by the U.N.'s cybersecurity executing arm – IMPACT - and the EC-Council is sponsoring over $400,000 worth of prizes. Regional championships will be held in various locations across different continents, and co-hosted with reputable IT/information security conferences and tradeshows, as follows: North America (Eastern) | Hacker Halted USA – Miami, USA North America (Western) | TakeDownCon – Las Vegas, USA South America | H2HC – Sao Paolo, Brazil Europe | Hacktivity – Budapest, Hungary Middle East & India | GITEX – Dubai, UAE Asia Pacific | Hacker Halted APAC – Kuala Lumpur, Malaysia Afric...

FOX Sports website database hacked and leaked by Shad0w One of the Biggest Fox Sports website with world rank 678 and millions of Readers/Day got hacked. Hacker named " Shad0w " release SQL injection Vulnerability on one of the sub domain of Fox Sports and exploit it to extract the database. Leaked database info posted on pastebin by hacker. Vulnerable link is also given in pastebin. Hacker also post the admin password hashes.