The Hacker News | #1 Trusted Source for Cybersecurity News — Index Page

A new botnet emerged from underground and is menacing payment world, the cyber threat dubbed vSkimmer come from Russia according revelation of McAfee security firm .  The security expert Chintan Shah wrote on a blog post that during monitoring of Russian underground forum found a discussion about a Trojan for sale that can steal credit card information from Windows PC for financial transactions and credit card payments.  vSkimmer agent is able to detect card readers on the victim’s machine and gather all the information from the Windows machines sending it to a remote control server encrypting it (Base64). The malware collects the following information from the infected machine and sends it to the control server: Machine GUID from the Registry Locale info Username Hostname OS version The vSkimmer malware indicated as the successor of the popular Dexter, a financial malware that targeted Point-of-Sale systems to grab card data as it transmitted during sales flow....

The mother of alleged Anonymous hacktivist Barrett Brown has pleaded guilty to helping her son hide two laptop computers from federal investigators. Brown's mother, Karen McCutchin , pleaded guilty last week to a charge of obstructing the execution of a search warrant. She faces a maximum sentence of 12 months in prison and a $100,000 fine. Sentencing has not yet been scheduled. On March 6, 2012, officers with the Federal Bureau of Investigation raided Brown’s Dallas, Texas apartment in an attempt to execute a search warrant for computers that could contain information involving hacktivist group Anonymous and LulzSec. The feds hadn't found all the computers they were looking for during a search of Brown's apartment that morning and Brown, located at his mother's house, refused to volunteer them. Karen McCutchin Plea Agreement Barrett Brown is expected to stand trial in September, at which point he will have spent an entire year behind bars witho...

Tibetan and Uyghur activists are once again targeted with a new malware, specially designed for Android devices. This is the first documented attack that targets Android smartphones . Security researchers at Kaspersky say they've  found a targeted malware attack on Android phones that seems to come from China. The attack relied heavily on social engineering, a kind of verbal manipulation, to hack into their targets’ devices. Malware seeks to steal information like contacts, call logs, and SMS of people who work in the field of human rights. Kaspersky has identified the Trojan as " Chuli ," after a command function that shows up prior to posting stolen data to the command-and-control server at the URL: hxxp://64.78.161.133/*victims's_cell_phone_number*/process.php. On March 24, the attackers infiltrated the email account of a high-profile Tibetan activist, and used that account to send a spear-phishing email to their contacts list. ...

A couple of years ago, the tech world was abuzz about the cloud. Cloud computing refers to computing where the processing or storage takes place on a networked series of computers rather than on the device that you’re using. Whether you’re using a PC, laptop, tablet, smartphone, television, or video game console, everything now connected to Cloud Storage and always in sync. But there is a limitation, that smartphones can essentially remember deleted information, which poses a huge risk to organizations that issue smartphones to employees and to organizations that don't explicitly disable the use of personal devices for work-related computing. Researchers at the University of Glasgow found that cloud storage apps that say they send files to the cloud also leave retrievable versions of files on the devices. They  tested some cloud-based file storage systems tested included Box, Dropbox and SugarSync on HTC Desire, running Android 2.1, and an iPhone 3S running iOS 3. They...

Oracle has released emergency patches multiple of times in recent months for Java for one after another set of vulnerabilities . About 100 million computers reported to be vulnerable to unauthorized access via different flaw in Java software. Department of Homeland Security's US-CERT already warned users to disable Java permanently to stop hackers from taking control of users' machines. Security experts advised,'T he best defense we have right now for these kinds of attacks is to disable Java in the browser forever' . According to Websense experts, Most browser installations use outdated versions of the Java plug-in that are vulnerable to at least one of several exploits used in popular web attack toolkit. Exploit kits are a very common tool for distribution of many Java-based threats. To detect the vulnerable Java versions that are installed on systems and Websense experts, used their technology via ' threat intelligence network' , which monitors bi...

Canonical, the software company that manages and funds Ubuntu, announced to develop a new, open-source operating system customized especially for Chinese users called ' UbuntuKylin OS '. According to the BBC, Chinese government and Canonical partner to launch its home grown operating system. China signaled its intention to move away from its dependence on western software products i.e windows. Canonical staff and Chinese researchers will be working on the OS at a Beijing lab. China's Ministry of Industry and Information Technology will collaborate with Canonical to come up with Kylin to run on servers, aimed at websites, online shops, and hosting. The first version of Ubuntu Kylin is for the laptops and desktops. Therefore the Android dominates the Chinese market for a few more years. The Ubuntu Kylin is not for the mobile device because Canonical already has the Ubuntu Mobile OS. Future releases will also include integration with Baidu maps and shoppi...

Apple is beefing up the security of its iCloud and Apple ID accounts by adding two-factor authentication to the account login process. Users who activate the option will be required to enter a four-digit code they may receive via SMS message, aside from the usual password. Two-factor authentication is gaining popularity because it makes login to online services significantly more secure compared to regular process. Apple has rolled out this functionality for Apple ID and iCloud users. " Turning on two-step verification reduces the possibility of someone accessing or making unauthorized changes to your account information at My Apple ID or making purchases using your account ," Apple said . Apple will be using both the app and SMS versions, providing security codes through texts as well as the FindMyiPhone app. As long as users are able to remember their password, they will have the ability to generate a new recovery key from the My Apple ID web...

T-Mobile devices having a default Wi-Fi Calling feature that keeps you connected in areas with little or no coverage using Wi-Fi connection. But according to new finding by students Jethro Beekman and Christopher Thompson from University of California Berkeley, that this feature lets millions of Android users vulnerable to Man-in-the-Middle attack . The simplest way to become a man-in-the-middle would be for the attacker to be on the same open wireless network as the victim, such as at a coffee shop or other public space. In a technical analysis of the exploit, The flaw could potentially allow hackers to access and modify calls and messages made by T-Mobile users on certain Android smartphones. Beekman and Thompson informed T-Mobile, a division of Deutsche Telekom, of the flaw in December and on March 18 T-Mobile was able to resolve the issue for all affected phone models. T-Mobile uses regular VoIP for Wi-Fi Calling instead of a connection that encry...

Yesterday we reported about a massive Cyber attack on South Korea that was responsible for shutting down networks of South Korean banks and TV broadcasters. Police are still investigating the cyber attack  but the country's Communications Commission has revealed that the hacking originated from a Chinese IP address. Symantec Security team analyze the code used in the cyber attacks against South Korea and they discovered an additional component used in this attack that is capable of wiping Linux machines.  The malware, which it called Jokra, contains a module for wiping remote Linux machines. ' The included module checks Windows 7 and Windows XP computers for an application called mRemote, an open source, multi-protocol remote connections manager. ' Symantec said. McAfee also published an analysis of the attack code, which wrote over a computer's master boot record, which is the first sector of the computer's hard drive that the computer checks before ...

The US government is claiming that authorities do not need court warrants to affix GPS devices to vehicles to monitor their every move. t's been more than a year since a Supreme Court decision established that affixing a GPS tracking device to a vehicle constitutes a search under the constitution. The decision, United States vs. Jones , throws out the drug-related conviction of nightclub owner Antoine Jones. The GPS locator was installed the day after the warrant expired and while the vehicle was outside of the department's jurisdiction, and DC police tracked Jones for nearly a month after installation before arresting him. " Requiring a warrant and probable cause before officers may attach a GPS device to a vehicle, which is inherently mobile and may no longer be at the location observed when the warrant is obtained, would seriously impede the government's ability to investigate drug trafficking, terrorism, and other crimes. Law enforcement officers co...

Russian anti-virus company Doctor Web reports that a new Mac OS X adware Trojan spreading itself via crafted movie trailer pages that prompt users to install a browser plugin. Basically, an adware is any software package which automatically renders advertisements in order to generate revenue for its author. Dubbed as ' Trojan.Yontoo.1 ', Attackers have provided a number of alternative ways to spread the threat. The Trojan can also be downloaded as a media player, a video quality enhancement program or a download accelerator. When victim visits the site, the dialogue only imitates the traditional plate and specially designed by hackers to enter a potential victim of misleading. After pressing the « Install the plug-in » victim is redirected to the site to download malware. When launched, Trojan.Yontoo.1 displays a dialogue window that asks the user if they want to install Free Twit Tube. after the user presses ‘ Continue ’, instead of the promis...

Computer networks at major South Korean banks and top TV broadcasters crashed simultaneously Wednesday, during a Massive cyber attack. South Korean police investigating reports from several major broadcasters and banks. least three broadcasters KBS, MBC and YTN and the Shinhan and Nonghyu banks reported that their computer networks had been crached. The state-run Korea Information Security Agency said that Screens went blank at 2 p.m. and more than seven hours later some systems were still down.  The take down was apparently not from a distributed denial-of-service (DDOS) attack, but a virus that has apparently infected machines in these organizations and delivered its payload simultaneously. An official at the Korea Communications Commission said investigators speculate that malicious code was spread from company servers that send automatic updates of security software and virus patches. The Associated Press says: " The latest network para...

Self-described troll and Grey hat AT&T Hacker Andrew "Weev" Auernheimer, 26, has been sentenced to 41 months in prison for exploiting an AT&T security hole three years ago, and releasing thousands of iPad owners email addresses. According to authorities, they obtained the ICC-ID and e-mail address for about 120,000 iPad users. Each charge carried with it a potential prison terms of five years. He will serve 41 months in a federal prison, with concurrent probation for three years. He also owes restitution to the U.S. Treasury to be dispersed to AT&T in the amount of $73,000. In 2010, Auernheimer and Daniel Spitler, discovered that visiting an unsecured AT&T Web server and entering a number associated with the customer's wireless account allowed him to obtain that customer's email address. Computer security researcher Charlie Miller tweeted " We could all go to jail for security research at any moment, and a jury would happily convi...

Researchers are already warning that malware authors developing more sophisticated attack techniques for mobile devices, using encryption and randomization or hiding malicious code in image files. As analyzed by Symantec a malicious Infrared X-Ray  Android application, attempting to lure Android device owners to download an app that supposedly allows the camera on the device to see through clothes. This malware app is spreading quickly widely in Japan by sending the spam messages via SMS to phone numbers stored in the device’s Contacts, so that the recipients of the spam to be tricked easier because the invitation to download the app is coming from someone they know rather than from an unknown sender. The app is designed to steals all details in the device's contact list and are uploaded to a predetermined server. Symantec  confirmed that there are several variants of this app exist, ". .the latest variants have added an interesting payload: rather...

Little more than a year ago I wrote about the possibility to attack gaming platform to compromise large audience of gamers in stealthy way, the access to millions of machines represent a dream for every attackers and I hypnotized its repercussion in cyber warfare domains. Gaming platform are usually complex systems equipped with the latest technology and the idea to exploit them as possible attack vectors cultivated by many governments. Researchers at ReVuln, Luigi Auriemma and Donato Ferrante , presented at Black Hat Europe 2013 in Amsterdam how to convert local bugs and features in remotely exploitable security vulnerabilities by using the popular EA Origin 3 platform as an attack vector against remote systems. EA Origin is one of the biggest gaming related digital delivery platforms with more than 40 million the access it to purchase games for any kind of platform, from mobile to PC. Before describe the discovery of the two Italian experts let's give analy...

During  March Patch Tuesday of 2013 , Microsoft released seven new security bulletins, with four rated as critical, and others as Important. Most interesting one was MS13-027 , which is rated as "important" because the attack requires physical access to the vulnerable machine. This flaw allows anyone with a USB thumb drive loaded with the payload to bypass security controls and access a vulnerable system even if AutoRun is disabled, and the screen is locked. Flaw exposes your Windows PCs to major risk. If you remember Stuxnet, worm was injected to Iran's nuclear program system using USB thumb drive. Windows typically discovers USB devices when they are inserted or when they change power sources (if they switch from plugged-in power to being powered off of the USB connection itself). To exploit the vulnerability an attacker could add a maliciously formatted USB device to the system. When the Windows USB device drivers enumerate the device, parsing a spe...

Once again Google Security Team Shoot itself in the foot. Ansuman Samantaray , an Indian penetration tester discovered a small, but creative Security flaw in Google drive that poses phishing threat to million of Google users was ignored  by Google Security team by replying that," It is just a mare phishing attempt,not a bug in Google ". According to Ansuman , he reported a JavaScript Script Execution vulnerability in Google Drive Files on 20th December 2012 to Google Security Team and but Google rejected the report on 21st December. Ability to execute malicious script through Google drive files poses security threats, not just phishing attack, but an attacker able to extends the attack to malware spreading, etc. The flaw exist in the way Google Drive preview the documents in the browser. Online preview of the files executing code written in doc files as HTML/JavaScript just by changing the value of a param...

It’s not a mystery, every nation is worried of the level of security of its infrastructure, the United States are among the most concerned governments due the high number of cyber-attack against its networks. US Government representative such us former States Secretary of Defense Leon Panetta and Secretary of Homeland Security Janet Napolitano warned in more than one occasion on the possible consequences of a cyber offensive and declared the necessity to improve the cyber capabilities of the country.  Senators are interested to evaluate the level of protection of nuclear stockpile of foreign governments against cyber attacks, question has been raised after that Pentagon's chief cyber officer admitted to ignore if countries such as Russia or China have adopted efficient countermeasures. Nelson and Armed Services Committee Chairman Sen. Carl Levin, D-Mich. will request to national intelligence an assessment about the ability of foreign states to safeguard networked ...

A critical vulnerability discovered in certain LaserJet Pro printers that could give remote attackers access to sensitive data. Homeland Security’s Computer Emergency Response Team recently issued a vulnerability note warning that HP LaserJet Professional printers contain a telnet debug shell which could allow a remote attacker to gain unauthorized access to data. This flaw was discovered by a Germany security expert, Christoph von Wittich . He detected the vulnerability during a routine network scan of his company's corporate network. He said the vulnerability could also be used for a denial-of-service attack. " As long as the printer is not connected to the Internet, this vulnerability should not cause much trouble for the end user ,". Marked as CVE-2012-5215 ( VU#782451 , SSRT101078), vulnerability affected 12 printer models including HP LaserJet Pro P1102w, P1102w, P1606dn, M1212nf MFP, M1213nf MFP, M1214nfh MFP, M1216nfh Multifunc...

Israeli mobile security start-up Skycure has exposed a vulnerability that could allow hackers to control and spy on iPhones. A major security vulnerability for iOS configuration profiles  pose malware threat. The vulnerability affects a file known as mobileconf files, which are used by cell phone carriers to configure system-level settings. These can include Wi-Fi, VPN, email, and APN settings. Apple used to use them to deliver patches, and carriers sometimes use them to distribute updates. Adi Sharabani , CEO and co-founder of Skycure, made a demonstration that how sensitive information, including the victim’s exact location, could be retrieved, while also controlling the user’s iPhone. In Demo, he setup a fake website with a prompt to install a configuration profile and sent the link out to Victim. After installing it, he found out they were able to pull passwords and other data without his knowledge. These malicious profiles can be emailed or ...