The Hacker News | #1 Trusted Source for Cybersecurity News — Index Page

A large distributed brute force attack against WordPress sites is understood to be occurring. A large botnet with more than 90,000 servers is attempting to log in by cycling through different usernames and passwords. According to a blog update on IXWebHosting, they are currently experiencing issues where there is a brute force attack on the default  WordPress  login pages of  their customers. " As you can see from our numbers, we were seeing 30 to 40 thousand attacks per day the last few months. In April 2013, it increased to 77,000 per day on average, reaching more than 100,000 attempts per day in the last few days. " Sucuri study says. This attack is greatly effecting Linux servers and attack is possibly conducted using  botnets . To solve the issue, hosting administrator block all connections to wp-login.php. " At this moment, we highly recommend you log into any WordPress installation you have and change the password to something that m...

It is a terrifying prospect, a hack that allows an attacker to take control of plane navigation and cockpit systems has been revealed at a security conference in Europe. This was demonstrated by Hugo Teso , a researcher at security consultancy N.Runs in Germany who's also a commercial airline pilot. He explained that by building an exploit framework called Simon and a complimentary Android app that delivers attack messages, he could manipulate a plane's path as he saw fit. “ You can use this system to modify approximately everything related to the navigation of the plane ,” Teso told reporters. Teso found he was able to eavesdrop on the system's communications over its 1MBps link, as well as blocking information and injecting data into link.  It took three years of hunting down holes in standard systems to work out how he could use radio signals to send his own navigation commands to a plane's control system, using publicly available Flight Management System (FMS) ...

You can install the industry’s strongest and most expensive firewall. You can educate employees about basic security procedures and the importance of choosing strong passwords. You can even lock-down the server room, but how do you protect a company from the threat of social engineering attacks? For any of you that are involved in security awareness efforts, you know what I am talking about. It could happen tomorrow, it could happen today or it might already have happened. In a recent disclosure  posted by renowned hacker and developer  DarkCoderSc (Jean-Pierre LESUEUR) explained that how one can easily Socially Engineer Microsoft Skype Support team to get access to any skype account. From a social engineering perspective, employees are the weak link in the chain of security measures in place. He simply used the weakness of Skype password recovery system itself. One simply need to request a new password to Skype support and aski...

Russian hackers have figured out a way to download free games from Ubisoft's servers, exploiting an existing vulnerability in Ubisoft's uPlay launcher. According to reports, the copies of Far Cry 3 Blood Dragon that are available on torrent sites are the result of a hack of Ubisoft's uPlay service. The hack has allowed users to download advance copies of Far Cry 3: Blood Dragon, a game which has yet to be officially released. Blood Dragon will be officially released on 1st May, for Xbox 360, PS3 and PC. As a proof of the exploit, hackers even posted an 1 hour 30 mins long footage of the game. A Ubisoft spokesman said that the company was aware of the issue and was working to resolve it quickly.  An earlier tweet on their account attributed yesterday's outage to hackers as well, saying " Servers were attacked which limited service from 2:30PM to 9:00PM Paris time [8:30AM to 3:00PM EST]. " The hackers developed a piece of software which tricks ...

Three members of the high profile internet hacktivist group LulzSec have admitted to their parts in a series of cyber attacks against the NHS, Sony and News International. Ryan Ackroyd, Jake Davis and Mustafa Al-Bassam, pleaded guilty to one charge of carrying out an unauthorized act to impair the operation of a computer, contrary to the Criminal Law Act 1977. In July 2011 the Sun's website was hacked and users were briefly re-directed to a spoof page that falsely claiming that Rupert Murdoch had died. Davis, from Shetland, and Bassam, a student from Peckham, south London, admitted conspiring to bring down the websites of law enforcement authorities in Britain and the US, including the CIA and the Serious Organized Crime Agency (SOCA). The group, an offshoot of the Anonymous hacktivists, but Both LulzSec and Anonymous wreaked havoc throughout 2011 and 2012, knocking thousands of websites offline and pilfering data from well-known companies. The men are said to h...

Researchers from Kaspersky Lab have discovered a new spam message campaign being transmitted via Skype contains malware capable of using an infected computer to mine for Bitcoins. The malware, identified as Trojan.Win32.Jorik.IRCbot.xkt . Bitcoin is a non-governmental, fully-digital currency based on an open-source and peer-to-peer internet protocol. Cybercriminals have figured out that distributed Bitcoin mining is a perfect task for botnets and have started developing malware that can abuse the CPUs and GPUs of infected computers to generate Bitcoins. " Bitcoin mining is the process of making computer hardware do mathematical calculations for the Bitcoin network to confirm transactions and increase security, " Victims are encouraged to install malware file that is included with messages like " this my favourite picture of you ". Those who click the links, infected with a virus dropper downloaded from a server in India. If the malicious file is ins...

A vulnerability in AirDroid application  which provides wireless management of your Android phone or tablet from any browser on the same Wi-Fi network allow hackers  to perform Dos attack from your Android device. Cross Site scripting or  XSS vulnerability in the browser version of AirDroid allows an attacker is able to send a malicious text message to the browser associated with the account when attacker is able to get access to a phone with AirDroid installed. According to advisory posted by US-Cert , When this message is viewed on the AirDroid web interface an attacker can conduct a cross-site scripting attack, which may be used to result in information leakage, privilege escalation, and/or denial of service on the host computer. Vulnerability is currently not patched and also AirDroid team didn't annouce any update regarding fix. As a general good security practice, only allow connections from trusted hosts and network...