The Hacker News | #1 Trusted Source for Cybersecurity News — Index Page

Security researchers have disclosed local zero day DLL hijacking vulnerabilities in several applications developed by Corel Software that could allow an attacker to execute arbitrary commands on victims' computer, potentially affecting more than 100 million users. The security holes were publicly disclosed by Marcos Accossatto from a vulnerability research firm Core Security after the vendor didn't respond to his private disclosure about the flaws. Corel develops wide range of products including graphics, photo, video and other media editing programs. According to the researcher, when a media file associated with one of the vulnerable Corel products is opened, the product also loads a specifically named DLL (Dynamic Link Library) file into memory if it's located in the same directory as the opened media file. These DLL files contain executable code which could allow an attacker to install malware on victims' computers by inserting malicious DLLs into the...

Security researcher has developed a cheap USB wall charger that is capable to eavesdrop on almost any   Microsoft   wireless  keyboard . MySpace mischief-maker Samy Kamkar has released a super-creepy keystroke logger for Microsoft wireless keyboards cunningly hidden in what appears to be a rather cheap, but functioning USB wall charger. The stealthy Arduino-based device, dubbed " KeySweeper ", looks and functions just like a generic USB mobile charger, but actually sniffs, decrypts, logs, and reports back all keystrokes from a Microsoft wireless keyboard. " KeySweeper is a stealthy Ardunio-based device camouflaged as a wall charger that wirelessly sniffs, decrypts, logs and reports-back all keystrokes from any Microsoft wireless keyboard in the vicinity," Kamkar said. The security researcher has also released instructions on how to build the USB wall charger online and surprisinglyits is cheap to build and quite capable. KeySweeper includes a web...

Multiple successors of the original Silk Road have come and all have been taken offline in recent years, but aside from selling illegal goods and services, they all have had one thing in common – they've all relied on the Tor network. A new version of the anonymous online black market Silk Road, has re-appeared on the dark web, but this time the website doesn't rely on the now infamous Tor network and neither it deals in only Bitcoins. The new version of the notorious online black market, dubbed " Silk Road Reload​ed ", launched Sunday on the little-known " I2P " anonymous network, dealing with a range of cryptocurrencies including the meme-inspired Dogecoin. In short, apart from the name, there is no connection between the original Silk Road website and the newly launched Silk Road Reloaded . Silk Road Reloaded is only accessible by downloading the special software called I2P (Invisible Internet Project) , or by configuring your systems...

Python supply chain attacks are surging in 2025. Join our webinar to learn how to secure your code, dependencies, and runtime with modern tools and strategies.

The terrible terrorist attacks in France forced the British Prime Minister David Cameron to consider banning the popular encrypted online messaging apps like Snapchat , CryptoCat ,  WhatsApp and Apple's iMessage unless the companies don't give the UK government backdoor access to their encrypted communications. Speaking at a public event in the UK this morning, Cameron said that if he wins the next election and re-elected, he would seek to ban the encrypted communication apps as part of his plans for new surveillance powers in the wake of the Charlie Hebdo shootings in Paris . The British Prime Minister said the Paris terror attacks, including the one last week on satirical newspaper Charlie Hebdo, outlined the need for greater access on the encrypted communications. In his remarks, the attacks were aimed at messaging apps that encrypt messages to secure users' communications. " The attacks in Paris demonstrated the scale of the threat that we face and th...

The official Twitter and YouTube accounts for the US military's Central Command ( CENTCOM ) that oversees operations in Central Asia and the Middle East were hacked on Monday by a hacker group claiming association with Islamic State militant group, also known as ISIS. The hacker group, appears to call itself " CyberCaliphate ", managed to gain access to the CENTCOM social accounts, and posted some screenshots of documents, allegedly internal CENTCOM documents, with links to what they described as leaked military files. Meanwhile, YouTube page related to the US military's Central Command was set to display propaganda videos in support of the terrorist group ISIS. On Twitter, the group posted a Pastebin message that declared " Pentagon networks hacked. AMERICAN SOLDIERS WE ARE COMING, WATCH YOUR BACK. ISIS. #CyberCaliphate . " Originally, a statement posted on pastebin shared by the compromised CENTCOM account reads: " US and its satelli...

Microsoft began issuing Patch Tuesday updates publically in advance over ten years ago, but from next every second Tuesday of the Month, if you want to see what security patches Microsoft is going to issue, then you will have to pay for it. UPDATE ALERTS FOR PAID CUSTOMERS ONLY Yes right, Microsoft has decided to ditch its Advanced Notification Service (ANS) and will no longer be releasing a public blog post to preview what is to come on Patch Tuesday. Microsoft is facing fierce criticism by industry experts for its decision to make advanced security bulletin available only to those who pay a premium. Note: Only advance notifications are now paid, but security updates/patches are free. NO MORE "OUT-OF-BAND" PUBLIC SECURITY ALERTS In the post on the Microsoft Security Response Center blog , Chris Betz, senior director at Microsoft's security research arm, said: " more and more customers today are seeking to cut through the clutter and obtain s...