The Hacker News | #1 Trusted Source for Cybersecurity News — Index Page

Security researchers have discovered a way to target a huge number of Android and iOS apps that could allow them to remotely sign into any victim's mobile app account without any knowledge of the victim. A group of three researchers – Ronghai Yang, Wing Cheong Lau, and Tianyu Liu – from the Chinese University of Hong Kong has found [ PPT ] that most of the popular mobile apps that support single sign-on (SSO) service have insecurely implemented OAuth 2.0. OAuth 2.0 is an open standard for authorization that allows users to sign in for other third-party services by verifying existing identity of their Google, Facebook, or Chinese firm Sina accounts. This process enables users to sign-in to any service without providing additional usernames or passwords. How are app developers required to implement OAuth? (Right Way) When a user logs into a third party app via OAuth, the app checks with the ID provider, let's say, Facebook, that it has correct authentication details. I...

Today, most of you surf the web unaware of the fact that websites collect your data and track your locations and makes millions by sharing your search histories, location data, and buying habits with advertisers and marketers. And if this isn't enough, there are hackers and cyber criminals out there who have the ability to easily steal your sensitive and personal data from the ill-equipped websites. In short, the bitter truth is that you have no or very little online privacy. To resolve this issue, you need a Virtual Private Network (VPN). If you are worried about online Privacy and have not thought about using a VPN, it might be time to get one. But, the question is: What are the best anonymous VPN services? Unfortunately, not all VPNs are as anonymous as they claim to be. Some VPN services keep extensive logs of their users' browsing activities, including IP-addresses for weeks, which nullify the point of using a VPN for privacy. Want Privacy While You Surf...

When we started our brand new THN Deals Store last week on the special occasion of company's 6th Anniversary, we introduced its very first product, Professional Hacking Certification Package, and received great response from our readers. Thank you! If you have not yet, you can still get this deal — Computer Hacker Professional Certification Package — at 96% discount. This Package offers you all the material and training you require to help pass any of five professional hacker certifications, including CISSP, CISM, CISA, Ethical Hacker and Forensics Investigator to become certified penetration tester. It is a very well known fact that nobody can teach you hacking directly. You need to learn some programming languages to get started, as well as to have knowledge of some basic platforms. I frequently receive emails and messages on what programming language should we learn? So the answer is — Python . But, Why Python? Because it is an excellent programming language that ha...

Image Source: Libelium Here's a new danger to your smartphone security: Your mobile device can be hijacked and tracked without your knowledge. Remember Stingrays ? The controversial cell phone spying tool, also known as " IMSI catchers ," has long been used by law enforcement to track and monitor mobile users by mimicking a cellphone tower and tricking their devices to connect to them. Sometimes it even intercepts calls and Internet traffic, sends fake texts, and installs spyware on a victim's phone. Setting up such Stingrays-type surveillance devices , of course, is expensive and needs a lot of efforts, but researchers have now found a new, cheapest way to do the same thing with a simple Wi-Fi hotspot. Yes, Wi-Fi network can capture IMSI numbers from nearby smartphones, allowing almost anyone to track and monitor people wirelessly. IMSI or international mobile subscriber identity is a unique 15-digit number used for authentication of a person when movi...

Note — We have published  an updated article on what really happened behind the alleged DDoS attack against Liberia using Mirai botnet. Someone is trying to take down the whole Internet of a country, and partially succeeded, by launching massive distributed denial-of-service (DDoS) attacks using a botnet of insecure IoT devices infected by the Mirai malware. It all started early October when a cyber criminal publicly released the source code of Mirai – a piece of nasty IoT malware designed to scan for insecure IoT devices and enslaves them into a botnet network, which is then used to launch DDoS attacks. Just two weeks ago, the Mirai IoT Botnet caused vast internet outage by launching massive DDoS attacks against DNS provider Dyn, and later it turns out that just 100,000 infected-IoT devices participated in the attacks. Experts believe that the future DDoS attack could reach 10 Tbps, which is enough to take down the whole Internet in any nation state. One such inc...