The Hacker News | #1 Trusted Source for Cybersecurity News — Index Page

Android Video Malware found in Japanese Google Play Store A new Trojan has been found, and removed, from the Google Play/Android Market, McAfee reported on Friday afternoon. The post says applications carrying the Trojan promise, and in some cases deliver, trailers for upcoming video games or anime or adult-oriented clips, but they also request "read contact data" and "read phone state and identity" permissions before being downloaded. McAfee Mobile Security detects these threats as Android/DougaLeaker .A, the company said.McAfee said that the fifteen malicious applications of this sort had been found on Google Play, and that all had been removed from the market. The app gathers the Android ID not the IMEI code that can uniquely identify the device, but the 64-bit number that is randomly generated on the device's first boot and remains with it for the life of the device. The app also harvests the phone's phone number and contact list, along with every n...

Sabpab - Another Mac os Backdoor Trojan Discovered Security firm Sophos has discovered more malware for the Mac OS X platform called Sabpab . It uses the same Java vulnerability as Flashback to install itself as a "drive-by download." Users of older versions of Java now have still more malware to worry about. It also doesn't require any user interaction to infect a system either just like Flashback all that needs to happen is for you to visit an infected webpage. Sabpab, according to Sophos, installs a backdoor that allows the hackers to capture screen snapshots, upload or download files and execute commands on infected Macs remotely. The Trojan creates the files /Users/ /Library/Preferences/com.apple.PubSabAgent.pfile /Users/ /Library/LaunchAgents/com.apple.PubSabAGent.plist Encrypted logs are sent back to the control server, so the hackers can monitor activity. Although one variant of Flashback installed a file in the LaunchAgents folder, not all tools for detectin...

Stuxnet was planted by Iranian double agent using memory stick The Stuxnet computer worm used to sabotage Iran's nuclear program was planted by a double agent working for Israel. The agent used a booby-trapped memory stick to infect machines deep inside the Natanz nuclear facility, according to a report published  on Wednesday. The worm is believed to have been placed on a specially crafted USB memory stick and handed over to a Natanz worker who, by all accounts, was an Iranian national belonging to a dissident group named Mujahideen-e Khalq (MEK). "The MEK has been listed as a 'foreign terrorist organization' since 1997 because of deadly attacks on Americans abroad, but members of the group have been trained at a secret site in Nevada. U.S. officials consider them 'the assassination arm of Israel's Mossad intelligence service' as they have been connected to the killing of five Iranian nuclear scientists since 2007. The incident with Stuxnet is not the fir...

FBI track Anonymous hacker using his girlfriend's boobs The FBI swooped on Higinio O Ochoa III after he posted the snap, which included a gloating message to his online victims.He took the picture on his iPhone and posted it on Twitter without realising it contained GPS data pointing directly to his house. Researching the username "w0rmer", investigators also found a reference online which included Ochoa's full name. Ochoa, is an alleged member of CabinCr3w, an offshoot of the hacktivist collective Anonymous. A criminal complaint filed in connection with the case reveals that pictures of a amply proportioned young woman taken in an outer-Melbourne suburb played a key role in the case. The snap posted by 30-year-old Ochoa shows a girl in a bikini top from the neck down, with a printed message pinned to her skirt reading: " PwNd by w0rmer & CabinCr3w " This GPS location allowed local police to easily track down the presumed residence of the woman pictured in the photo, ...

[ Call for Articles ] The Hacker News Magazine - Hacktivism Special Edition - May 2012 A big shout out to all you cowboys and cowgirls who want to stir up some thoughtful reading and discussions by submitting to The Hacker News Magazine articles regarding Hacktivism . As you know, Hacktivism is the use of computers and computer networks as a means of protest to promote political ends. Given that, we'd love to have your articles to print in our May 2012 magazine . So, get to writing and wrangling.. CYBER WARFARE [ Download Here ] -  Last Month (April) The Hacker News turns over every leaf of the newest way world citizens are fighting wars and using their keyboards to destroy planet earth.  Join us as we explore this new frontier and let us know how you feel and what you have learned! If you enjoy our monthly publication, please spread the word! By sharing our free magazine with your family, friends, co-workers and other security experts, you're helping t...

Botnets, DDoS attacks as weapon against financial sector DDOS attacks against the financial sector almost tripled during the first quarter of this year, according to DDoS mitigation specialist Prolexic. The firm also reported a 3,000 per cent quarter-on-quarter increase in malicious packet traffic targeted at the financial services sector, compared with the final quarter of 2011. China leads the way as the country from where DDoS attacks originate, followed by the U.S., Russia, then India. Prolexic says " more than 10 of the worlds largest banks due to market capitalization ," and " an almost threefold increase in the number of attacks against its financial services ". A distributed denial-of-service attack is one in which several compromised systems attack a single target, causing denial of service for legitimate users. The flood of incoming messages to the target system essentially forces it to shut down, thereby denying service. The average attack bandwidth...

Ransomware replaces Windows MBR and asking users for Money Security researchers from TrendMicro, F-Secure and Dr. Web have intercepted two new ransomware variants currently circulating in the wild. This new ransomware variant prevents infected computers from loading Windows by replacing their master boot record (MBR) and displays a message asking users for money. Cris Pantanilla, a threat response engineer at Trend Micro said, " Based on our analysis, this malware copies the original MBR and overwrites it with its own malicious code ," " Right after performing this routine, it automatically restarts the system for the infection take effect ." The MBR is a piece of code that resides in the first sectors of the hard drive and starts the boot loader. The boot loader then loads the OS. Instead of starting the Windows boot loader, the rogue MBR installed by the new ransomware displays a message that asks users to deposit a sum of money into a particular account via...