The Hacker News | #1 Trusted Source for Cybersecurity News — Index Page

iPad 2 iOS 5 Lock Screen Bypass Vulnerability Marc Gurman at 9to5Mac has discovered a vulnerability on the iPad that allows for a limited bypass of the device’s lockscreen. Anyone with an iPad Smart Cover can gain access to the previously-open app (or the home screen if no app was open). By holding the power button to bring up the ‘Power Off’ screen, closing the smart cover, re-opening it, and clicking cancel, the attacker will be dropped into the screen that was open before the iPad was locked. If the attacker gets dropped into the home screen, then they’ll be able to see the installed apps, but won’t be able to open anything. If Safari or Mail (or any other app) was the open when the device was locked, then the attacker would have access to that app. From a locked iPad 2: 1) Lock a password protected iPad 2 2) Hold down power button until iPad 2 reaches turn off slider 3) Close Smart Cover 4) Open Smart Cover 5) Click cancel on the bottom of the screen This isn’t the f...

Stuxnet's Son " Duqu " Removal Tool released by Bitdefender Rootkit.Duqu is a new e-threat that combines the technology of the military-grade Stuxnet with an advanced keylogger and backdoor application. Due to its rootkit technology, the piece of malware can stay hidden from the user, the operating system’s defense mechanism and even from regular antivirus utilities.Just like its predecessor – the Stuxnet rootkit - Rootkit.Duqu.A is digitally signed with a stolen digital certificate that has been revoked in the meantime. This allows it to install itself on both 32- and 64-bit operating systems on Windows platforms ranging from Windows XP to Windows 7. The Duqu rootkit runs on the computer for 36 days and collects any kind of information entered via the keyboard, including passwords, e-mail or IM conversations. After the “surveillance” period ends, the rootkit gracefully removes itself from the system, along with the keylogger component. Rootkit malware is extremely diff...

Hackers leak Citigroup CEO ’s personal data after Occupy Wall Street arrests The mobile phone number and home address of Vikram Pandit, the chief executive of Citigroup, have been placed on the web by hacking group CabinCr3w in retaliation for the cuffing of protesters at an Occupy Wall Street demo. The hackers said in a statement online that they had accessed the data - which also included family information and some financial figures - and uploaded it online in response to events during the recent anti-bank protests on Wall Street. " During Occupy Wall Street [protests], protesters had made way to CitiBank to withdraw their funds and close their accounts. They were met with strong police prescence [sic] and arrested ," CabinCr3w wrote. " We as american citizens MUST have full control over our money and lively hood[sic].When this is taken away from us, what else do we have? So the CEO of CitiBank has blindly jumped into the sights of the CabinCr3w ". PLa...

OSSAMS - Open Source Security Assessment Management System As information security professionals, we conduct security assessments for companies. One of the biggest problems we have is after all the data is collected, how can we correlate the data accurately. So we decided to start a project to solve this problem, and we are calling it Open Source Security Assessment Management System (OSSAMS). OSSAMS is a framework for putting configuration files, security scan data files (like Nessus), and other data collected, during a security assessment or penetration test, into a RDBMS. The framework is going to be designed in a fashion similar to Metasploit, SNORT, or other systems that allow the security community to create plugins for new tasks as needed. The primary goal of OSSAMS is to normalize the data, there by allowing the security professional to better assess the current state of security for an organization. Completed: acunetix, burp, grendel, nessus, netsparker, nexpose commu...

Beware - Gaddafi malware on Internet As is not unusual when big news breaks, malware authors try to take advantage of the situation.A global computer virus that hides in an email about Gaddafi's death has been detected by Norman . The malware was caught in its worldwide network of spam traps. The email below was sent to a mailing list that receives information pertaining to the Uighur people. The mail appears to have been sent from Korea. Malicious hackers have spammed out an attack posing as pictures of Gaddafi's death, tricking users into believing that they came from the AFP news agency and are being forwarded by a fellow internet user. As unlikely as the legitimacy of these emails may seem - in this case, the latest photos being forwarded to you in an email attachment - the news is often just too interesting for people to ignore. Internet users are advised to avoid opening the email and updating or applying their security settings.

iPhone can be used as spy phone to get desktop Keystrokes What if a hacker could log every key you typed on your PC by placing a cellphone nearby? US researchers have shown how this is possible using any smartphone available today. At a conference in Chicago on Thursday, a group of computer researchers from Georgia Tech will report on another potential threat. The researchers have shown that the accelerometer and orientation sensor of a phone resting on a surface can be used to eavesdrop as a password is entered using a keyboard on the same surface. They were able to capture the words typed on the keyboard with as much as 80 percent accuracy. Normally when security researchers describe spyware on smartphones, they mean malicious code that can be used to snoop on calls, or to steal the data held on mobile phones.In this case, however, researchers have described how they have put software on smartphones to spy on activity outside the phone itself - specifically to track what a use...