Search results for security | Breaking Cybersecurity News | The Hacker News

Hacker Halted USA 2011 - 10 Reasons Why You Should Attend Hacker Halted is a global series of Computer and Information Security conferences presented by EC-Council. The objective of the Hacker Halted conferences is to raise international awareness towards increased education and ethics in IT Security. The event is currently in its 14th year. Also present at Hacker Halted is EC-Council's H@cker Halted | Academy, trainings and workshops led by EC-Council instructors and trainers. Hacker Halted returns to Miami for the 3rd year in a row will be held in Miami on 25th and 27th October 2011. Participate and be part of one of the world's most recognized information security conference. Gain perspective through keynote addresses on the current state of information security as well as emerging trends and threats. An information security conference with a comprehensive agenda. Choose from the various focused tracks covering critical domains of information security. Match your informati

Barracuda Networks Tuesday announced it will pay more than $3,100 to anyone who can hack into its security products, saying the bug bounty program is the first ever from a pure-play security vendor. Barracuda Networks Tuesday announced it will pay more than $3,100 to anyone who can hack into its security products, saying the bug bounty program is the first ever from a pure-play security vendor. "This initiative reflects our commitment to our customers and the security community at large," says Paul Judge, chief research officer at Barracuda. The security firm lists its Spam & Virus Firewall, Web Filter, Web Application Firewall and NG Firewall as products in its bug bounty program. Patch or we go public, says bug bounty program   Google last week launched a bug-bounty program to pay for vulnerabilities, and many other vendors are willing to pay security researchers for information about vulnerabilities they'd like to be able to fix as soon as possibl

It comes as no surprise that today's cyber threats are orders of magnitude more complex than those of the past. And the ever-evolving tactics that attackers use demand the adoption of better, more holistic and consolidated ways to meet this non-stop challenge. Security teams constantly look for ways to reduce risk while improving security posture, but many approaches offer piecemeal solutions – zeroing in on one particular element of the evolving threat landscape challenge – missing the forest for the trees.  In the last few years, Exposure Management has become known as a comprehensive way of reigning in the chaos, giving organizations a true fighting chance to reduce risk and improve posture. In this article I'll cover what Exposure Management is, how it stacks up against some alternative approaches and why building an Exposure Management program should be on  your 2024 to-do list. What is Exposure Management?  Exposure Management is the systematic identification, evaluation,

Arab Countries websites urged to Increase Security Against Israeli Hackers Recent hacking attacks online have gotten the attention of the world's media outlets in a big way. What has been reported as beginning as a youth led hacker attack against an Israeli website quickly escalated when six Israeli hackers decided to strike back. The initial attack was against a sports themed web site based in Israel and exposed the credit card and personal information of a number of nationals in that country.  The response, exposed the credit card and personal details of more than 50,000 people in Arab countries such as Saudi Arabia. While this current episode is rather tame in comparison to the Stuxnet virus which hit Iran in June of 2010, which ended up destroying several centrifuges inside an Iranian nuclear facility. Experts say that the web application security of Arab web sites must be increased if they are to be prepared for the potential cyber warfare that Israeli hackers could one day

Google has started rolling out this month's security updates for its mobile operating system platform to address a total of 33 new security vulnerabilities affecting Android devices, 9 of which have been rated critical in severity. The vulnerabilities affect various Android components, including the Android operating system, framework, library, media framework, as well as Qualcomm components, including closed-source components. Three of the critical vulnerabilities patched this month reside in Android's Media framework, the most severe of which could allow a remote attacker to execute arbitrary code on a targeted device, within the context of a privileged process, by convincing users into opening a specially crafted malicious file. "The severity assessment is based on the effect that exploiting the vulnerability would possibly have on an affected device, assuming the platform and service mitigations are turned off for development purposes or if successfully bypas

Update: ' Hack The Pentagon ' has opened registration for its pilot bug bounty program of $150,000 for hackers in return for the vulnerabilities they find in its public facing websites. The Defense Department has enlisted the bug bounty startup HackerOne to manage the pilot program. Interested hackers can Register Now to participate in the Bug Bounty program. The United States Department of Defense (DoD) has the plan to boost their internal and network security by announcing what it calls "the first cyber Bug Bounty Program in the history of the federal government," officially inviting hackers to take up the challenge. Dubbed " Hack the Pentagon ," the bug bounty program invites the hackers and security researchers only from the United States to target its networks as well as the public faced websites which are registered under DoD. The bug bounty program will begin in April 2016, and the participants could win money (cash rewards)

You might have heard the latest news about Microsoft blocking new security patches and updates for Windows 7 and Windows 8.1 users running the latest processors from Intel, AMD, Qualcomm, and others. Don't panic, this new policy doesn't mean that all Windows 7 and 8.1 users will not be able to receive latest updates in general because Microsoft has promised to support Windows 7 until 2020 , and Windows 8.1 until 2023. But those who have upgraded their machines running older versions of Windows to the latest processors, or manually downgraded their new laptops to run Windows 7/8.1 would be out of luck. A recently published Microsoft Knowledge Base article suggests that if you are running the older version of operating systems on your computers that feature new processors, including Intel's 7th generation Core i3, i5 and i7 ("Kaby Lake"), AMD Ryzen ("Bristol Ridge") and Qualcomm 8996 chips or later, the security updates will not install. Inste

Is TrueCrypt Audited Yet? Yes, In Part!  One of the world's most-used open source file encryption software trusted by tens of millions of users - TrueCrypt is being audited by a team of experts to assess if it could be easily exploited and cracked. Hopefully it has cleared the first phase of the audit and given a relatively clean bill of health. TrueCrypt is a free, open-source and cross-platform encryption program available for Windows, OSX and Linux that can be used to encrypt individual folders or encrypt entire hard drive partitions including the system partition.  The program is also capable to do some amazing things, such as can create a hidden operating system on a computer, essentially an OS within an OS where users can keep their most secret files. EVERYONE HAS SOMETHING TO HIDE TrueCrypt developers are anonymous and used the aliases " ennead " and " syncon ", perhaps to avoid unwelcome attention from their own governments. But when we talk about Privacy an

#Security Alert : Facebook Two-Factor Authentication fail ! Last year Facebook has launched a security feature called Login Approvals or two-factor authentication. This is a follow-up security update regarding Facebook Login from Facebook. They have already integrated Facebook login email alerts to get notification emails or SMS messages whenever a suspicious person uses your Facebook account from a different location. Christopher Lowson , on his blog explains the Facebook Two-Factor Authentication, which is really another biggest fail of Facebook Security. But that feature is not enough to ensure your account's security and that is why Facebook has launched "Login Approvals". This feature is very similar with Google 2-step verification which associates a mobile device with your Facebook account and authenticates the login by sending a verification code at your mobile phone device. According to this feature, When user will logging into your Facebook account from a new device, a

Apple has announced a new post-quantum cryptographic protocol called  PQ3  that it said will be integrated into iMessage to secure the messaging platform against future attacks arising from the threat of a practical quantum computer. "With compromise-resilient encryption and extensive defenses against even highly sophisticated quantum attacks, PQ3 is the first messaging protocol to reach what we call Level 3 security — providing protocol protections that surpass those in all other widely deployed messaging apps," Apple  said . The iPhone maker described the protocol as "groundbreaking," "state-of-the-art," and as having the "strongest security properties" of any cryptographic convention deployed at scale. PQ3 is the latest security guardrail erected by Apple in iMessage after it switched from  RSA  to Elliptic Curve cryptography ( ECC ), and by protecting encryption keys on devices with the Secure Enclave in 2019. While the current algorith

Chinese hackers not only attacked key federal departments: they also cracked into the computer system of the House of Commons, targeting MPs with large ethnic Chinese constituencies, CTV News has learned. Sources say Canada's secret cyber spy agency -- the Communications Security Establishment -- tracked the hacking operation to the Chinese embassy in Ottawa and to computer servers in Beijing. Toronto MP Derek Lee said Canada needs to show it's capable of fighting back. "It's unacceptable and I think we should hold out some threat -- a counter-strike threat," he said. But Canada might be falling behind when it comes to defending -- and retaliating -- against such attacks. Britain spends $1 billion on cyber security and the United States $55 billion, while Canada has a budget of $90 million. Meanwhile, security experts say the Chinese hackers who have targeted Canadian government computers are just the latest in a wave of cyberspace spies, and Ottawa needs to bols

A new "post-exploitation tampering technique" can be abused by malicious actors to visually deceive a target into believing that their Apple iPhone is running in Lockdown Mode when it's actually not and carry out covert attacks. The novel method, detailed by Jamf Threat Labs in a  report  shared with The Hacker News, "shows that if a hacker has already infiltrated your device, they can cause Lockdown Mode to be 'bypassed' when you trigger its activation." In other words, the goal is to implement Fake Lockdown Mode on a device that's compromised by an attacker through other means, such as  unpatched security flaws  that can trigger execution of arbitrary code. Lockdown Mode , introduced by Apple last year with iOS 16, is an  enhanced security measure  that aims to safeguard high-risk individuals from sophisticated digital threats such as mercenary spyware by  minimizing the attack surface . What it doesn't do is prevent the execution of mali

Researchers at Mocana, a security technology company in San Francisco, recently discovered they could hack into a best-selling Internet-ready HDTV model with unsettling ease. They found a hole in the software that helps display Web sites on the TV and leveraged that flaw to control information being sent to the television. They could put up a fake screen for a site like Amazon.com and then request credit card billing details for a purchase. They could also monitor data being sent from the TV to sites. "Consumer electronics makers as a class seem to be rushing to connect all their products to the Internet," said Adrian Turner, Mocana's chief executive. "I can tell you for a fact that the design teams at these companies have not put enough thought into security." Mocana and firms like it sell technology for protecting devices and often try to publicize potential threats. But the Mocana test also illustrates what security experts have long warned: that the arrival of Internet TVs, s

In Brief Microsoft's August Patch Tuesday offers nine security bulletins with five rated critical, resolving 34 security vulnerabilities in Internet Explorer (IE), Edge, and Office, as well as some serious high-profile security issues with Windows. A security bulletin, MS16-102 , patches a single vulnerability (CVE-2016-3319) that could allow an attacker to control your computer just by getting you to view specially-crafted PDF content in your web browser. Users of Microsoft Edge on Windows 10 systems are at a significant risk for remote code execution (RCE) attacks through a malicious PDF file. Web Page with PDF Can Hack Your Windows Computer Since Edge automatically renders PDF content when the browser is set as a default browser, this vulnerability only affects Windows 10 users with Microsoft Edge set as the default browser, as the exploit would execute by simply by viewing a PDF online. Web browsers for all other affected operating systems do not automatically

AT&T has confirmed a security data breach in which attackers have compromised the security of a number of its mobile customers and stolen personal information including Social Security numbers and call records. Back in April this year, AT&T suffered a data breach in which some of its customer information, including birth dates and Social Security numbers had been inappropriately accessed by three employees of one of its third-party vendors, in order to generate codes that could be used to unlock devices. Moreover, the hackers would have also been able to access its users' credit report with Customer Proprietary Network Information (CPNI) during the process without proper authorization, that means the information related to what subscribers purchase from AT&T would also have been compromised. The Dallas-based telecommunications giant did not specify the number of customers or type of information affected by this data breach, but state law requires such di

Members of the hacker community are leery of working with the government and sharing their skills, if it means navigating through outdated regulations and being viewed as potential security risks. Hackers and other computer experts willing to collaborate with the Department of Homeland Security to bolster the nation's cyber-defense are unable to do so because of red tape, according to the former head of the department. Tom Ridge and Michael Chertoff, two former secretaries of Homeland Security, joined current DHS boss Janet Napolitano to discuss the evolution of threats facing the United States, including the challenges of securing cyber-space. They expressed their views during a March 2 roundtable discussion at Georgetown University, which was webcast by the Aspen Institute, marked the department's eighth anniversary. "The portfolio of threats is a lot broader," Ridge said. There are a number of possible scary scenarios, including a sophisticated hacker from another country break

The recent hacking of CBI's website by a group called ' Pakistani Cyber Army ' has raised questions over the safety regulations of servers provided by National Informatics Centre (NIC) , the organisation responsible for maintaining government servers. While the NIC maintains a studied silence over the entire issue, sources in the security establishment say that the safety mechanism of the NIC was not up to the mark and several reminders were being sent to them for upgrading their hardware. The official website of the CBI was hacked by the ' Pakistani Cyber Army ' on the intervening night of December 3 and 4. The CBI had yesterday registered a case against unknown persons in this connection. A report " Shadows in the Cloud " by a Canadian think-tank comprising " Information Warfare Monitor " and " Shadows Server " earlier this year said there was evidence of a cyber espionage network that compromised government, business

Adobe has released an important security bulletin that addresses a total of 23 Critical vulnerabilities in Adobe Flash Player. The security fixes for Windows, Linux and Mac users address "critical [flaws] that could potentially allow [attackers] to take control of the affected system," the company warned in an advisory on Monday. Out of 23 critical flaws, 18 address issues that would have allowed attackers to remotely execute arbitrary code on affected machines and take over control of them. Critical Vulnerabilities These 18 security vulnerabilities, all deemed highly critical, are as follows: Type Confusion Vulnerability (CVE-2015-5573) Use-after-free flaws (CVE-2015-5570, CVE-2015-5574, CVE-2015-5581, CVE-2015-5584, and CVE-2015-6682) Buffer overflow bugs (CVE-2015-6676 and CVE-2015-6678) Memory corruption vulnerabilities that could lead to Remote Code Execution (CVE-2015-5575, CVE-2015-5577, CVE-2015-5578, CVE-2015-5580, CVE-2015-5582, CVE-2

Security researchers are warning of a new, easy-to-exploit email trick that could allow an attacker to turn a seemingly benign email into a malicious one after it has already been delivered to your email inbox. Dubbed Ropemaker (stands for Remotely Originated Post-delivery Email Manipulation Attacks Keeping Email Risky), the trick was uncovered by Francisco Ribeiro, the researcher at email and cloud security firm Mimecast. A successful exploitation of the Ropemaker attack could allow an attacker to remotely modify the content of an email sent by the attacker itself, for example swapping a URL with the malicious one. This can be done even after the email has already been delivered to the recipient and made it through all the necessary spam and security filters, without requiring direct access to the recipient's computer or email application, exposing hundreds of millions of desktop email client users to malicious attacks. Ropemaker abuses Cascading Style Sheets (CSS) and Hyp