The Hacker News | #1 Trusted Source for Cybersecurity News — Index Page

Researchers from Kaspersky Lab have discovered a new spam message campaign being transmitted via Skype contains malware capable of using an infected computer to mine for Bitcoins. The malware, identified as Trojan.Win32.Jorik.IRCbot.xkt . Bitcoin is a non-governmental, fully-digital currency based on an open-source and peer-to-peer internet protocol. Cybercriminals have figured out that distributed Bitcoin mining is a perfect task for botnets and have started developing malware that can abuse the CPUs and GPUs of infected computers to generate Bitcoins. " Bitcoin mining is the process of making computer hardware do mathematical calculations for the Bitcoin network to confirm transactions and increase security, " Victims are encouraged to install malware file that is included with messages like " this my favourite picture of you ". Those who click the links, infected with a virus dropper downloaded from a server in India. If the malicious file is ins...

A vulnerability in AirDroid application  which provides wireless management of your Android phone or tablet from any browser on the same Wi-Fi network allow hackers  to perform Dos attack from your Android device. Cross Site scripting or  XSS vulnerability in the browser version of AirDroid allows an attacker is able to send a malicious text message to the browser associated with the account when attacker is able to get access to a phone with AirDroid installed. According to advisory posted by US-Cert , When this message is viewed on the AirDroid web interface an attacker can conduct a cross-site scripting attack, which may be used to result in information leakage, privilege escalation, and/or denial of service on the host computer. Vulnerability is currently not patched and also AirDroid team didn't annouce any update regarding fix. As a general good security practice, only allow connections from trusted hosts and network...

Exploit kits are one of the dangerous cyber crime tool, where The Phoenix Exploit Kit is a good example of exploit packs used to exploit vulnerable software on the computers of unsuspecting Internet users. The Phoenix Exploit Kit is available for a base price of $2,200 in underground market by its malware author or developer.  Like other exploit kits , Phoenix also developed to exploit browser-based  vulnerabilities in outdated and insecure versions of browser plugins like Java, and Adobe Flash and Reader. Developer of Phoenix is known by nickname AlexUdakov on several forums. According to new investigation report published by  krebsonsecurity , AlexUdakov was also member of a forum called Darkode , whose administrator accounts were compromised few weeks before and that the intruders were able to gain access to private communications of the administrators.  Intruders was able to view full profiles and database of Dar...

A cyber attack campaign, dubbed #OpIsrael by hacking group Anonymous, targeting Israeli websites caused massive disruption to government, academic and private sites Sunday. Israeli media said small business had been targeted. Some homepage messages were replaced with anti-Israel slogans. Anonymous threatened to disrupt and erase Israel from cyberspace in protest over its mistreatment of Palestinians. In response to the eight day assault that killed 133 Palestinians , Anonymous defaced thousands of Israeli sites and provided information for Gazans facing Internet and communications blackouts.  60 million hacking attempts were reportedly made. Most of the attacks have had little impact, and Israeli experts even say they welcome the attempts as ways of sharpening their defenses. Israel itself is accused of taking part in much more sophisticated cyber attacks against its enemies, particularly Iran. List of all hacked sites are available in fo...

Microsoft has released an advance notification of 9 security bulletins that it plans to release on April 9, 2013. Microsoft said it will patch nine vulnerabilities in total and two of them rated critical and that of the remaining 7 as Important. The critical vulnerabilities are remote code execution issues. First vulnerability affects Microsoft Windows and Internet Explorer while the second vulnerability affects Microsoft Windows.  The vulnerability will fix a flaw that allows a drive-by attack, which hackers can exploit to attack machines running the software using malware loaded websites. Earlier this year, Microsoft released an emergency update for Internet Explorer after all the commotion about the security holes in Java. The update aimed to patch a security vulnerability in Internet Explorer that is being used for attacks on government contractors and other organisations. The remaining 7 vulnerabilities pertain to issues affecting Microsoft Office, Microsof...

We are on the eve of the fateful day, April 7th , the collective of Anonymous announced a massive cyber attack against the state of Israel as part of the campaign started in the last months and named #OpIsrael . The hacktivists are conducting a massive call to army to recruit new forces and inform all the members of collective of the cyber attack planned against Israeli network infrastructures. The hacktivists protest against Israeli bombing of Palestinian territory expressing solidarity with the Palestinian people condemning Israeli Government and its decisions.  The hackers motivated to The Hackers Post website their participation with following statement: “ Israel isn’t stopping human rights violations. It’s to show solidarity with newly recognized Palestinian state.” “the hacking teams have decided to unite against Israel as one entity…Israel should be getting prepared to be erased from the internet. ” Anonymous has promised to ‘ erase Israel from the internet ’ in a coo...

A 17 year old alleged hacker accused of being associated with Anonymous hacker appeared in Parramatta Children's Court on Friday, over multiple unauthorised access crime on the behalf of hacktivist collective Anonymous. The Australian Federal Police ( AFP ) issued a statement over the matter, saying that a search warrant was issued at the youth's home in Glenmore Park, New South Wales, in November last year. The youth has been charged with six counts of unauthorised modification of data to cause impairment, one count of unauthorised access with intent to commit a serious offence, one count of possession of data with intent to commit a computer offence, and 12 counts of unauthorised access to restricted data.  " Australian Federal Police investigates various types of cybercrime and will continue to take a strong stance against these perpetrators " Suspected hacker faces a maximum of 10 years jail time if convicted and will face court again ...

Cybercriminals, underground hacking communities, hacker's market and Exploit packs.... Russian  cyberspace is well known for such crazy hacking stuff. Recently, the original Carberp botnet developer   ring that stole millions from bank accounts worldwide has been arrested. According to a report from Russian newspaper, a group of 20 people who served as its malware development team, were arrested by the Sluzhba Bezpeky Ukrayiny and the Federalnaya sluzhba bezopasnosti Rossiyskoy Federatsii (federal security service of Russia, FSB) in cities around Ukraine. Over $250 million has been stolen by the members of the botnet ring, which had roughly 20 members aged between 25 and 30. “ Our experts did an enormous amount of work, which resulted in identifying the head of this criminal group, the owner and operator of a specialized banking botnet, identifying the control servers, and identifying the directing of traffic from popular websites in order t...

World's largest Digital documents library 'Scribd' announced that, they were hacked in a recent attack and  hacker potentially able to compromise general user information, which includes usernames, emails, and encrypted passwords of partial database. " Even though this information was accessed, the passwords stored by Scribd are encrypted " They emailed every user whose password was potentially compromised with details of the situation and instructions for resetting their password. " Earlier this week, Scribd's Operations team discovered and blocked suspicious activity on Scribd's network that appears to have been a deliberate attempt to access the email addresses and passwords of registered Scribd users. " Scribd team said on blog post. If your account was among those affected, visit http://www.scribd.com/password/check and Check that you are one of the lucky victim or not, I got " Good news - your password was not among thos...

The digital currency Bitcoin has suffered yet another hack. Bitcoin wallet site Instawallet has been taken offline after a security compromise, has suspended its service indefinitely. Instawallet didn't say in a notice on its website how many bitcoins were stolen after hackers fraudulently accessed company database. " The Instawallet service is suspended indefinitely until we are able to develop an alternative architecture. Our database was fraudulently accessed, due to the very nature of Instawallet it is impossible to reopen the service as-is. " Bitcoin is a virtual currency that uses a peer-to-peer system to confirm transactions through public key cryptography. The company also announced it will accept claims for individual Instawallets for the first 90 days, using the wallets’ URL and key to file the claim. Clients will then be refunded the currency value if the balance is less than 50 BTC. The breach follows a series of attacks targeting bitcoin services. In Sep...

In earlier posts, our Facebook hacker ' Nir Goldshlager ' exposed two serious Facebook oAuth Flaws. One, Hacking a Facebook account even without the user installing an application on their account and second, various ways to bypassing the regex protection in Facebook OAuth. This time, Nir illustrated a scenario attack  " what happens when a application is installed on the victim’s account and how an attacker can manipulate it so easily " According to hacker, if the victim has an installed application like Skype or Dropbox, still hacker is able to take control over their accounts.  For this, an attacker required only a url redirection or cross site scripting  vulnerability on the Facebook owner app domain i.e in this scenario we are talking about skype facebook app. In many bug bounty programs URL redirection is not considered as an valid vulnerability for reward i.e Google Bug bounty Program. Nir also demonstrated...

J. Taikwok Yung is 33, lives with his mom in Brooklyn, and bought domain names that criticize billionaire Donald Trump and cybersquatting him.  Cybersquatting  is a legitimate crime that’s defined by the Anticybersquatting Consumer Protection Act. " Cybersquatting (also known as domain squatting), according to the United States federal law known as the Anticybersquatting Consumer Protection Act, is registering, trafficking in, or using a domain name with bad faith intent to profit from the goodwill of a trademark belonging to someone else. The cybersquatter then offers to sell the domain to the person or company who owns a trademark contained within the name at an inflated price. " from wikipedia. Donald Trump is seeking $400,000 in damages from a Brooklyn man, who register four domains trumpindia.com, trumpbeijing.com, trumpmumbai.com and trumpabudhabi.com as domain names of well-known trademarks and then try to sell the names back to the trademark owners...

Spammy Facebook apps are nothing new, the web giant has been dealing with suspicious behavior apps since the website launched the Facebook Platform for developers in 2007. As an open source app development tool, anyone can create an app, including people who really just want to steal your information, and your money. With cyber crime  including identity theft, on the rise, more Facebook users should begin to pay closer attention to what they click on, especially if it is shared in a spammy way. Sophos reports that nearly 60,000 people have clicked on one scam in particular, which is one that promises to allow you to see who has viewed your profile. The app automatically posts a comment to the users timeline, and sometimes posts as a photo with the message ‘ OMG OMG OMG… I cant believe this actually works! Now you really can see who viewed your profile ! on (link here). ‘ The app does not actually allow users to see profile views but instead leads them, and anyone...

We are in digital era, everything is connected to the large networks and applications benefit of even more complex devices that deeply interact with owner, in this scenario security requirements assume a crucial importance and security of overall architecture also depend on security of single components. In these months mobile users have gone crazy for a simple video game named Ruzzle , developed by the Swedish gaming company MAG Interactive, available for iOS and Android devices. The game mechanism is inspired by the board games Boggle and Scrabble. Early 2013 the researcher at Hacktive Security started a study on most spread mobile applications such as popular Ruzzle focusing on the protocol implemented and possible repercussion on user’s privacy. Ruzzle protocol use Json for response within a user’s session, security analyst discovered that is it possible to tamper them due the absence of control on server side on data sent by the application. The leak of data va...

Hacking group Anonymous claims to have broken into North Korean site Uriminzokkiri.com and got their hands on more than 15,000 user credentials. A message posted online makes the claim and includes details for six accounts, apparently showing user names, e-mail addresses, birth dates, and hashed passwords. " Enjoy these few records as a proof of our access to your systems (random innocent citizens, collateral damage, because they were stupid enough to choose idiot passwords), we got all over 15k membership records of www.uriminzokkiri.com and many more. First we gonna wipe your data, then we gonna wipe your badass dictatorship "government" ." Of the six users, three have Korean names and the other three appear to be Chinese. " North Korean government is increasingly becoming a threat to peace and freedom. We demand: - N.K. government to stop making nukes and nuke-threats,  uncensored internet access for all the citizens  and Kim Jong-un to resign " Fo...

Cyber criminals  are using popular note-taking app Evernote as Command-and-Control Server to give commands to the malware installed on infected PCs using botnets. TrendMicro uncovered a malware detected as “ BKDR_VERNOT.A ” tried to communicate with Command-and-Control Server using Evernote. Malware delivered via an executable file that installs the malware as a dynamic-link library. The installer then ties the DLL into a legitimate running process, hiding it from casual detection. Once installed, BKDR_VERNOT.A can perform several backdoor commands such as downloading, executing, and renaming files. It then gathers information from the infected system, including details about its OS, timezone, user name, computer name, registered owner and organization. Researchers  also pointed out that the backdoor may have also used Evernote as a location to upload stolen data. " Unfortunately, during our testing, it was not able to logi...

The last week has seen probably the largest distributed denial-of-service (DDoS) attack ever. A massive 300Gbps was thrown against Internet blacklist maintainer Spamhaus' website but the anti-spam organisation , CloudFlare was able to recover from the attack and get its core services back up and running.  Spamhaus, a group based in both London and Geneva, is a non-profit organisation that aims to help email providers filter out spam and other unwanted content. Spamhaus is pretty resilient, as its own network is distributed across many countries, but the attack was still enough to knock its site offline on March 18. Five national cyber-police-forces are investigating the attacks.  A group calling itself STOPhaus,  an alliance of hactivists and cyber criminals is believed to responsible for bombarding Spamhaus with up to 300Gbps. The attacks on Spamhaus illustrate a larger problem with the vulnerability of systems fundamental to the architecture of...

A new botnet emerged from underground and is menacing payment world, the cyber threat dubbed vSkimmer come from Russia according revelation of McAfee security firm .  The security expert Chintan Shah wrote on a blog post that during monitoring of Russian underground forum found a discussion about a Trojan for sale that can steal credit card information from Windows PC for financial transactions and credit card payments.  vSkimmer agent is able to detect card readers on the victim’s machine and gather all the information from the Windows machines sending it to a remote control server encrypting it (Base64). The malware collects the following information from the infected machine and sends it to the control server: Machine GUID from the Registry Locale info Username Hostname OS version The vSkimmer malware indicated as the successor of the popular Dexter, a financial malware that targeted Point-of-Sale systems to grab card data as it transmitted during sales flow....

The mother of alleged Anonymous hacktivist Barrett Brown has pleaded guilty to helping her son hide two laptop computers from federal investigators. Brown's mother, Karen McCutchin , pleaded guilty last week to a charge of obstructing the execution of a search warrant. She faces a maximum sentence of 12 months in prison and a $100,000 fine. Sentencing has not yet been scheduled. On March 6, 2012, officers with the Federal Bureau of Investigation raided Brown’s Dallas, Texas apartment in an attempt to execute a search warrant for computers that could contain information involving hacktivist group Anonymous and LulzSec. The feds hadn't found all the computers they were looking for during a search of Brown's apartment that morning and Brown, located at his mother's house, refused to volunteer them. Karen McCutchin Plea Agreement Barrett Brown is expected to stand trial in September, at which point he will have spent an entire year behind bars witho...

Tibetan and Uyghur activists are once again targeted with a new malware, specially designed for Android devices. This is the first documented attack that targets Android smartphones . Security researchers at Kaspersky say they've  found a targeted malware attack on Android phones that seems to come from China. The attack relied heavily on social engineering, a kind of verbal manipulation, to hack into their targets’ devices. Malware seeks to steal information like contacts, call logs, and SMS of people who work in the field of human rights. Kaspersky has identified the Trojan as " Chuli ," after a command function that shows up prior to posting stolen data to the command-and-control server at the URL: hxxp://64.78.161.133/*victims's_cell_phone_number*/process.php. On March 24, the attackers infiltrated the email account of a high-profile Tibetan activist, and used that account to send a spear-phishing email to their contacts list. ...