The Hacker News | #1 Trusted Cybersecurity News Site — Index Page

Hacktivism Breached 174 Million Records in 2011 According to the Verizon 2012 Data Breach Investigations Report released on Thursday, Hacktivists stole more data from large corporations than cybercriminals in 2011, according to a study of significant security incidents. The report surveyed 855 data breaches, where a combined 174 million digital records were purloined. Although a large number of records were compromised in 2011, the year was only the second-highest since Verizon began collecting breach information in 2004. " While a few 2011 breach victims estimated their losses to be in the hundreds of millions of dollars, most did not get near to that amount ," it said. " In fact, the large majority of them emerged relatively unscathed from their troubles. " In the report, Verizon, pointing to the " Arab Spring " protests, called 2011 " a year of civil and cultural uprising ."Certainly, hacktivists such as LulzSec did hog a good deal of the

Cross-site scripting (XSS) Vulnerability reported on Paypal Paypal is affected by an XSS vulnerability where it fails to validate input on URL shown in above image. PayPal fixed the vulnerability shortly after being notified that its publicly posted. XSS, in general is a vulnerability that allows hackers to inject client side script on webpages and can modify how a user sees the webpage An attacker able to trick a user with a valid Paypal session into clicking a crafted version of the link below (wouldn't be hard, think a link on an eBay auction listing or a phishing e-mail for example) could hijack the user's session and initiate financial transactions on their behalf including money transfers. Alternatively this legitimate URL could be used to redirect the user to a spoofed PayPal web site designed to steal user credentials, which is a fairly common scam except in this case more effective as the user would see an actual PayPal URL to click on. [ Source ]

It comes as no surprise that today's cyber threats are orders of magnitude more complex than those of the past. And the ever-evolving tactics that attackers use demand the adoption of better, more holistic and consolidated ways to meet this non-stop challenge. Security teams constantly look for ways to reduce risk while improving security posture, but many approaches offer piecemeal solutions – zeroing in on one particular element of the evolving threat landscape challenge – missing the forest for the trees.  In the last few years, Exposure Management has become known as a comprehensive way of reigning in the chaos, giving organizations a true fighting chance to reduce risk and improve posture. In this article I'll cover what Exposure Management is, how it stacks up against some alternative approaches and why building an Exposure Management program should be on  your 2024 to-do list. What is Exposure Management?  Exposure Management is the systematic identification, evaluation,

US Army's CECOM Data leaked by Hacker Hacker Black Jester recently published contract information from a Web site connected to the U.S. Army Communications and Electronics Command (CECOM). " 30 record sets that include names, user IDs, physical addresses, email addresses, telephone numbers, and clear-text passwords were published in a Pastebin document ," writes Softpedia . "' Old crappy server, but has good info inside it. The list is not complete due the lazy condition and msaccess db , enjoy!' the hacker wrote next to the data dump ," Kovacs writes. The Pastebin post doesn't contain the name of the site from where the data was leaked, but the hacker provided us with the IP address associated with it. That IP address led us to a Software Engineering Services site on which only "eligible users" may register.

Carberp Banking Trojan Scam - 8 Arrested in Russia 8 Men suspected of being involved in the Carberp phishing scam have been arrested in Russia. The men were arrested after a joint investigation by the Russian Ministry of Internal Affairs (MVD) and Federal Security Service (FSB). According to the MVD, the investigation found that two brothers were the ringleaders of the gang, and developed a plan to steal money from the accounts of online banking customers. The eight suspects allegedly stole more than 60 million Rubles ($2 million) from 90 victims using the Carberp Trojan. Russian security firm who assisted with the investigation, pegged the stolen loot at 130 million Rubles ($4.5 million). Police confiscated computers, bank cards, notary equipment, fake documentation, and more than 7 million Rubles ($240,000) in cash during the raid. The gang used the Carberp and RDP-door Trojans to snare victims. Carberp is a well-known Trojan that was recently seen on Facebook as part of a scam

Face to Face with Duqu malware Once again we discuss about Stuxnet, cyber weapons and of the malware that appears derivate from the dangerous virus. The international scientific community has defined a Stuxnet deadly weapon because been designed with a detailed analysis of final target environment supported by a meticulous intelligence work that for the first time in history has embraced the world of information technology. The agent was designed with the intent to strike the Iranian nuclear program and even more clear is who has always opposed such a program, U.S. and Israel first, and consider also the technology skill necessary to develope a weapon with the observed architecture is really high. Extremely important two factors af the event: 1. the choose of control systems as target of the malware. 2. the conception of the virus as an open project, a modular system for which it was designed a development platform used to assemble the deadly cyber weapons in relation to the final

Vulnerability in Google Earth Software exposed by longrifle0x Ucha Gobejishvili, Security researcher also known as Longrifle0x , found another Interesting Security issue in one of the most famous software called,  Google Earth. He found a critical code execution vulnerability on google earth software client. For Proof of Concept , One can download any version of Google Earth, Then open "Click Placemark" , Put a malicious code there as one sample given below and Execute your code. Another past bug hunting by  Longrifle0x : 1.)  Cross Site Scripting (XSS) Vulnerability in Google 2.)  Skype Cross Site Vulnerabilities, user accounts can be Hijacked 3.) [POC] Buffer Overflow Vulnerability in GOM Media Player v. 2.1.37 and More..

CNCERT Claims - Raising Web attacks on China China's National Computer Network Emergency Response Technical Team (CNCERT/CC)is claiming attacks on public and private organisations from outside of its borders have rocketed in the past year from five million computers affected in 2010 to 8.9m in 2011. They found 47,000 foreign IP address involved in remotely accessing and controlling computers in China during a random sample investigation in 2011. ' This shows that Chinese websites still face a serious problem from being maliciously attacked by foreign hackers or IP addresses ,' Mr Wang Minghua, deputy director of the team's operation department. It said Japan was the source of most attacks, 22.8 percent, followed closely by the United States, 20.4 percent, and the Republic of Korea, 7.1 percent. China has the world's largest Internet population. The number of its Internet users reached 485 million last June. However, a high percentage of that population had experi

NASA sub-domain and Australian Police targeted by Hackers Hacker with name " Black Jester " hack another subdomain (  https://airtrafficconflictresolutions.arc.nasa.gov )   of  NASA. Hacker compromise the database of site and leak password hashes of Users and Database Info also. The leaked info posed on Pastebin Note . In Another Attack, Hacker - S3rver.exe managed to breach the official website of the International Police Association of Australia (ipa-australiapolice.com.au). A Pastebin paste made by the hackers contains the site's database structure along with names, usernames, email addresses and password hashes, Softpedia Reported. The hackers claim that they have warned International Police Association representatives that the site contains some serious vulnerabilities, but apparently they did nothing to secure it. The hackers also tried to root the servers, but apparently it can't be rooted.

Casa Presidencial website defaced by Latinhack The  Casa Presidencial website  was in temporary control of hackers on  Sunday . The minister explained that the hack was noticed while doing a backup of the site. The cyber-attack was attributed to a group called Latinhack, whose members have perpetrated more than 13,000 attacks on various government sites in Spain, the United Kingdom, Venezuela, Chile and the Dominican Republic. He also said the website's information was never at risk because it is physically stored in different places at separate servers, so these events do not affect users. The prez's website is based on Joomla's Content Management System (CMS) which according to experts is vulnerable to hacks if not regularly maintained.