#1 Trusted Cybersecurity News Platform Followed by 4.50+ million
The Hacker News Logo
Get the Free Newsletter
SaaS Security

Search results for Hijack | Breaking Cybersecurity News | The Hacker News

MavenGate Attack Could Let Hackers Hijack Java and Android via Abandoned Libraries

MavenGate Attack Could Let Hackers Hijack Java and Android via Abandoned Libraries

Jan 22, 2024 Software Security / Supply Chain
Several public and popular libraries abandoned but still used in Java and Android applications have been found susceptible to a new software supply chain attack method called MavenGate. "Access to projects can be hijacked through domain name purchases and since most default build configurations are vulnerable, it would be difficult or even impossible to know whether an attack was being performed," Oversecured  said  in an analysis published last week. Successful exploitation of these shortcomings could allow nefarious actors to hijack artifacts in dependencies and inject malicious code into the application, and worse, even compromise the build process through a malicious plugin. The mobile security firm added that all Maven-based technologies, including Gradle, are vulnerable to the attack, and that it sent reports to more than 200 companies, including Google, Facebook, Signal, Amazon, and others. Apache Maven is  chiefly used  for building and managing Java-based projec
Exploiting GPS vulnerability to Hijack Ships, Airplanes with $3000 Equipments

Exploiting GPS vulnerability to Hijack Ships, Airplanes with $3000 Equipments

Jul 27, 2013
The GPS expert Todd Humphreys , professors at the University of Texas, demonstrated that just using a cheap apparatus composed by a small antenna, an electronic GPS " spoofer " built in $3,000 and with a laptop, it is possible to exploit GPS vulnerability to obtain control of sophisticated navigation system aboard a 210-foot super-yacht in the Mediterranean Sea.  Humphreys demonstrated the exploit of a GPS vulnerability aboard the yacht " White Rose of Drachs " commanded by Capt. Andrew Schofield, the official and his crew were stunned by the effect of the attack. Humphreys is a famous GPS experts, we met him last year when we discussed about drones hacking . The Assistant Professor of the University of Texas with his team has created the world's most powerful GPS spoofer that was tested on GPS-based timing devices used in mobile phone transmitters. Humphreys reported the results of his experiment to the Foxnews explaining how his team exploited the GPS system of t
Making Sense of Operational Technology Attacks: The Past, Present, and Future

Making Sense of Operational Technology Attacks: The Past, Present, and Future

Mar 21, 2024Operational Technology / SCADA Security
When you read reports about cyber-attacks affecting operational technology (OT), it's easy to get caught up in the hype and assume every single one is sophisticated. But are OT environments all over the world really besieged by a constant barrage of complex cyber-attacks? Answering that would require breaking down the different types of OT cyber-attacks and then looking back on all the historical attacks to see how those types compare.  The Types of OT Cyber-Attacks Over the past few decades, there has been a growing awareness of the need for improved cybersecurity practices in IT's lesser-known counterpart, OT. In fact, the lines of what constitutes a cyber-attack on OT have never been well defined, and if anything, they have further blurred over time. Therefore, we'd like to begin this post with a discussion around the ways in which cyber-attacks can either target or just simply impact OT, and why it might be important for us to make the distinction going forward. Figure 1 The Pu
Unpatchable 'DoubleAgent' Attack Can Hijack All Windows Versions — Even Your Antivirus!

Unpatchable 'DoubleAgent' Attack Can Hijack All Windows Versions — Even Your Antivirus!

Mar 22, 2017
A team of security researchers from Cybellum, an Israeli zero-day prevention firm, has discovered a new Windows vulnerability that could allow hackers to take full control of your computer. Dubbed DoubleAgent , the new injecting code technique works on all versions of Microsoft Windows operating systems, starting from Windows XP to the latest release of Windows 10. What's worse? DoubleAgent exploits a 15-years-old undocumented legitimate feature of Windows called " Application Verifier ," which cannot be patched. Application Verifier is a runtime verification tool that loads DLLs (dynamic link library) into processes for testing purpose, allowing developers quickly detect and fix programming errors in their applications. Unpatchable Microsoft Application Verifier Exploit The vulnerability resides in how this Application Verifier tool handles DLLs. According to the researchers, as part of the process, DLLs are bound to the target processes in a Windows Regist
cyber security

Automated remediation solutions are crucial for security

websiteWing SecurityShadow IT / SaaS Security
Especially when it comes to securing employees' SaaS usage, don't settle for a longer to-do list. Auto-remediation is key to achieving SaaS security.
Iranian engineer hijack U.S. drone by GPS hack [Video Explanation]

Iranian engineer hijack U.S. drone by GPS hack [Video Explanation]

Dec 17, 2011
An Iranian engineer working on the captured US drone has said that Iran exploited a weakness in the craft's navigation system to hijack it. The aircraft was downed through a relatively unsophisticated cyber-attack that tricked its global positioning systems (GPS). The technique, known as " GPS spoofing " has been around for several years, and the Iranians began studying it in 2007, the engineer reportedly said. The U.S. Department of Energy notes that GPS is widely used, but insecure, although few users have taken note. GPS signals for the U.S. military are similarly insecure, and drones often rely on signals from multiple satellites. It's possible to spoof unencrypted civilian GPS systems. But military GPS receivers, such as the one likely installed on the missing drone, use the encrypted P(Y)-code to communicate with satellites. " With spoofing, an adversary provides fake GPS signals. This convinces the GPS receiver that it is located in the wrong place and/or time ," t
Exclusive Interview with TiGER-M@TE (Bangladesh Google website Hacker)

Exclusive Interview with TiGER-M@TE (Bangladesh Google website Hacker)

Jan 12, 2011
Update : Latest Hack by TiGER-M@TE :  700,000 sites on Inmotion Hosting Server hacked in one shot On the morning of Saturday, Jan 8, 2011 the biggest news of cyber world was -  Google Bangladesh website (Google.com.bd) Hacked by TiGER-M@TE  . TiGER-M@TE is a Bangladeshi Hacker, He was already connected to "The Hacker News" from last 2-3 months for providing his Hacks News ! Finally we take a small interview of this great Hacker, who make Google Down !! Unix Root          -  Tell us Some Introduction about you. TiGER-M@TE -  Me TiGER-M@TE , nationality Bangladeshi. I've Been hacking since 2007 and I work alone.I like to exploit servers rather than exploiting web application and I use only 0days and private exploits. Unix Root          -  Do you Hack Google on Jan 8, 2011 and Why ? TiGER-M@TE -  I've hacked not only Google but also local domain of Yahoo, Avast, Microsoft, Bing, Nokia and Kaspersky. Unix Root         - How you Hack google ? plz mention the metho
Millions of LinkedIn Users at Risk of Man-in-the-Middle Attack

Millions of LinkedIn Users at Risk of Man-in-the-Middle Attack

Jun 19, 2014
Two year back in 2012, one of the most popular online social networking sites Linkedin spent between $500,000 and $1 million on forensic work after millions of its users' account passwords were compromised in a major security data breach. But, it seems that the company hasn't learned any lesson from it. WHAT IS MAN-IN-THE-MIDDLE (MitM) ATTACK Before moving on to the story, let us discuss some emerging and common threats against the social networking sites nowadays. If we talk about less publicized but more danger, then Man-in-the-Middle (MitM) attack is the most common one. By attempting MitM attack, a potential attacker could intercept users' internet communication, steal sensitive information and even hijack sessions. Though MitM attacks are popular and have existed for years, a major categories of today's largest websites and social networking sites still haven't taken the necessary steps to safeguard their users' personal and sensitive data from the vulnerabil
Hacking Facebook Account with 'Reconnect' Tool

Hacking Facebook Account with 'Reconnect' Tool

Mar 11, 2015
" Signup or Login with Facebook " ?? You might think twice before doing that next time. A security researcher has discovered a critical flaw that allows hackers take over Facebook accounts on websites that leverage ' Login with Facebook ' feature. The vulnerability doesn't grant hackers access to your actual Facebook password, but it does allow them to access your accounts using Facebook application developed by third-party websites such as Bit.ly , Mashable , Vimeo , About.me , Stumbleupon , Angel.co and possibly many more. FLAW EXPLOITS THREE CSRFs PROTECTION Egor Homakov , a researcher with pentesting company Sakurity, made the social network giant aware of the bug a year ago, but the company refused to fix the vulnerability because doing so would have ruined compatibility of Facebook with a vast number of websites over the Internet. The critical flaw abuses the lack of CSRF ( Cross-Site Request Forgery ) protection for three different proce
Another way to hack Facebook accounts using OAuth vulnerability

Another way to hack Facebook accounts using OAuth vulnerability

Apr 17, 2013
In recent few months White hat Hacker ,' Nir Goldshlager ' reported many critical bugs in Facebook OAuth  mechanism, that allowed an attacker to hijack any Facebook account without user's interaction.  Another hacker, ' Amine Cherrai ' reported a new Facebook OAuth flaw, whose exploitation is actually very similar to Nir Goldshlager 's findings but with a new un-patched way. Before reading further, I would like to suggest you to read following post to understand the basic exploitation mechanism: Facebook OAuth flaw allows gaining full control over any Facebook account Facebook hacking accounts using another OAuth vulnerability URL Redirection flaw in Facebook apps push OAuth vulnerability again in action Now, if you are aware about the vulnerability used against Facebook OAuth in  redirect_uri parameter in  the URL, there is another way that  Amine Cherrai found, to bypass the patch applied by Facebook  security team. He found another
New Android Browser Vulnerability Is a “Privacy Disaster” for 70% Of Android Users

New Android Browser Vulnerability Is a "Privacy Disaster" for 70% Of Android Users

Sep 17, 2014
A Serious vulnerability has been discovered in the Web browser installed by default on a large number (Approximately 70%) of Android devices, that could allow an attacker to hijack users' open websites, and there is now a Metasploit module available to easily exploit this dangerous flaw. The exploit targets vulnerability ( CVE-2014-6041 ) in Android versions 4.2.1 and all older versions and was first disclosed right at the start of September by an independent security researcher Rafay Baloch, but there has not been much public discussion on it. The Android bug has been called a " privacy disaster " by Tod Beardsley, a developer for the Metasploit security toolkit, and in order to explain you why, he has promised to post a video that is " sufficiently shocking ." " By malforming a javascript: URL handler with a prepended null byte, the AOSP, or Android Open Source Platform (AOSP) Browser) fails to enforce the Same-Origin Policy (SOP) browser secur
One-Click Exploit Could Have Let Attackers Hijack Any Atlassian Account

One-Click Exploit Could Have Let Attackers Hijack Any Atlassian Account

Jun 24, 2021
Cybersecurity researchers on Wednesday disclosed critical flaws in the Atlassian project and software development platform that could be exploited to take over an account and control some of the apps connected through its single sign-on ( SSO ) capability. "With just one click, an attacker could have used the flaws to get access to Atlassian's publish Jira system and get sensitive information, such as security issues on Atlassian cloud, Bitbucket and on premise products," Check Point Research said in an analysis shared with The Hacker News. After the issues were reported to Atlassian on Jan. 8, 2021, the Australian company deployed a fix as part of its  updates  rolled out on  May 18 . The sub-domains affected by the flaws include -  jira.atlassian.com confluence.atlassian.com getsupport.atlassian.com partners.atlassian.com developer.atlassian.com support.atlassian.com training.atlassian.com Successful exploitation of these flaws could result in a supply-ch
Hackers Probably Can't Hijack an Airplane with Software

Hackers Probably Can't Hijack an Airplane with Software

Apr 12, 2013
An alarming dispatch from the Hack In The Box security conference in Amsterdam arrived on Wednesday: a hacker says he's found a way to take over airplane controls . That's probably not true. At least according to the Federal Aviation Administration (FAA), the European Aviation Safety Administration (EASA) and Honeywell, the maker's of the cockpit software, it's not. The FAA, for one, says, " The described technique cannot engage or control the aircraft's autopilot system using the FMS or prevent a pilot from overriding the autopilot. " The agency assures America that this hack " does not pose a flight safety concern because it does not work on certified flight hardware. " So why did Hugo Teso, the German hacker in question, tell everybody at the conference as well as countless journalists who've latched on to the story that he could take over the software? Well, Teso says he's successfully taken over a plane's controls in a flight
Hacker Demonstrates How Easy In-flight Entertainment System Can Be Hacked

Hacker Demonstrates How Easy In-flight Entertainment System Can Be Hacked

Dec 20, 2016
Next time when you hear an announcement in the flight, " Ladies and gentlemen, this is your captain speaking… ," the chances are that the announcement is coming from a hacker controlling your flight. Dangerous vulnerabilities in an in-flight entertainment system used by the leading airlines, including Emirates, United, American Airlines, Virgin, and Qatar, could let hackers hijack several flight systems and even take control of the plane. According to security researchers from IOActive , the security vulnerabilities resides in the Panasonic Avionics In-Flight Entertainment (IFE) system used in planes run by 13 major airlines, providing a gateway for hackers which is absolutely terrifying. The security holes could be exploited by hackers that could allow them to spoof flight information like map routes, speed statistics, and altitude values, and steal credit card information. IOActive's Ruben Santamarta managed to "hijack" in-flight displays to change info
How to Hack Facebook Accounts? Just Ask Your Targets to Open a Link

How to Hack Facebook Accounts? Just Ask Your Targets to Open a Link

Feb 18, 2019
It's 2019, and just clicking on a specially crafted URL would have allowed an attacker to hack your Facebook account without any further interaction. A security researcher discovered a critical cross-site request forgery (CSRF) vulnerability in the most popular social media platform that could have been allowed attackers to hijack Facebook accounts by simply tricking the targeted users into clicking on a link. The researcher, who goes by the online alias "Samm0uda," discovered the vulnerability after he spotted a flawed endpoint (facebook.com/comet/dialog_DONOTUSE/) that could have been exploited to bypass CSRF protections and takeover victim's account. "This is possible because of a vulnerable endpoint which takes another given Facebook endpoint selected by the attacker along with the parameters and makes a POST request to that endpoint after adding the fb_dtsg parameter," the researcher says on his blog . "Also this endpoint is located under t
Hackers Hijack YouTube Official North Korea, Twitter Accounts !

Hackers Hijack YouTube Official North Korea, Twitter Accounts !

Jan 22, 2011
Hackers Hijack YouTube Official North Korea, Twitter Accounts Online piracy has had a dangerous goal this weekend when they hacked youtube North Korea's official and Twitter accounts. Rather than strictly content Pyongyang's YouTube channel, the hacker posted a video cartoon version of the son of dictator Kim Jong-il and heir, Kim Jong-un, driving a luxury sport utility vehicle in a number of starving Register reported. The video parody surface Saturday (Jan. 8), the anniversary of Kim Jong-un. North Korea's official Twitter page used to send several scathing attacks on the leadership of the country, including one who chastised Kim Jong-il spend money on a nuclear weapons program, while 3 million people starving and freezing to death. " It is unclear who initiated the online sabotage, but Reuters reported that several members of the South Korean Internet forum called Dcinside claimed responsibility for the prank. News Source : Google
New Exploit to 'Hack Android Phones Remotely' threatens Millions of Devices

New Exploit to 'Hack Android Phones Remotely' threatens Millions of Devices

Mar 17, 2016
Attention Android users! Millions of Android devices are vulnerable to hackers and intelligence agencies once again – Thanks to a newly disclosed Android Stagefright Exploit . Yes, Android Stagefright vulnerability is Back… …and this time, the Stagefright exploit allows an attacker to hack Android smartphones in 10 seconds just by tricking users into visiting a hacker's web page that contains a malicious multimedia file. A group of security researchers from Israel-based research firm NorthBit claimed it had successfully exploited the Stagefright bug that was emerged in Android last year and described as the "worst ever discovered" . The new Stagefright exploit, dubbed Metaphor , is detailed in a research paper [ PDF ] that guides bad guy, good guy as well as government spying agencies to build the Stagefright exploit for themselves. Just yesterday, we reported about critical vulnerabilities in Qualcomm Snapdragon chip that could be exploited
Hijacking WhatsApp Account in Seconds Using This Simple Trick

Hijacking WhatsApp Account in Seconds Using This Simple Trick

Jun 05, 2015
The hugely popular smartphone messaging service WhatsApp, acquired by Facebook for over $20 billion last year, has reportedly been found to be prone to hijacking without unlocking or knowing your device password, making its hundreds of Millions of users vulnerable to, not just hackers, but also non-technical people. This trick lets anyone surrounds you to get effectively control over your WhatsApp account. The attacker needs nothing more than a phone number of the target person and access to the target mobile phone for a few seconds, even if it is locked. Hacking Whatsapp account in such scenario is not hard for your friends and colleagues. This is not actually a loophole or vulnerability in WhatsApp, and rather it is just the way WhatsApp is designed and its account setup mechanism works. NOTE: Moreover, we aren't encouraging users to hack others WhatsApp account , but the purpose of publishing this article is to warn and remind our readers that you should be extr
'Google Analytics by Yoast' WordPress Plugin Patches Critical Vulnerability

'Google Analytics by Yoast' WordPress Plugin Patches Critical Vulnerability

Mar 21, 2015
Another popular WordPress plugin by Yoast has been found to be vulnerable to a critical flaw that could be exploited by hackers to hijack the affected website. The critical vulnerability actually resides in the highly popular Google Analytics by Yoast plugin, which allows WordPress admins to monitor website traffic by connecting the plugin to their Google Analytics account. The Google Analytics by Yoast WordPress plugin has been downloaded nearly 7 Million times with more than 1 million active installs, which makes the issue rather more serious. A week back, we reported that all the versions of ' WordPress SEO by Yoast ' was vulnerable to Blind SQL Injection web application vulnerability that allowed an attacker to execute arbitrary payload on the victim WordPress site in order to take control of it. However, the Google Analytics by Yoast plugin is vulnerable to persistent cross-site scripting (XSS) vulnerability that allows hackers to execute malicious PHP code on the server, whic
Cybersecurity Resources