The Hacker News | #1 Trusted Cybersecurity News Site — Index Page

Hackers Exploit Unpatched Windows XML vulnerability An unpatched vulnerability in the Microsoft XML Core Services (MSXML) is being exploited in attacks launched from compromised websites to infect computers with malware. This zero-day exploit that potentially affects all supported versions of Microsoft Windows, and which has been tied to a warning by Google about state-sponsored attacks, has been identified carrying out attacks in Europe. Microsoft security bulletin MS12-037 was this month's cumulative update for Internet Explorer. It is rated as Critical, and addresses 14 separate vulnerabilities that affect every supported version of Internet Explorer in some way.One vulnerability in particular is more urgent than the rest, though. There are multiple attacks circulating online that target CVE-2012-1875 .The name of the vulnerability is " Same ID Property Remote Code Execution Vulnerability ", which doesn't really explain much. Until a patch is released, the Microsoft workaround

Scamming site taken down by Hackers When hundreds of kids were duped into taking courses to improve their grades with a promise of an ipod if they succeeded, many pressured their parents to help find the company called Advantage Point Academy (https://www.advantagepoint.org/) a place to administer the lessons. Advantage point got parents in many schools through California, Oregon, and Washington to rent rooms and give their kids lessons that supposedly made them smarter........with a prize of an ipod when they finished. Advantage Point got their money for enrolling the kids but the kids got lessons and no ipods. Kids and parents have been calling, writing, reporting to the States and posting complaints on the companies Facebook page to no avail. In stepped xL3gi0n , who felt that if nothing else, a little web removal would bring solace to a disappointed and scammed group of parents and kids. On June 21st in the wee hours of the morning the site was taken down and all files remove

Identities now transcend human boundaries. Within each line of code and every API call lies a non-human identity. These entities act as programmatic access keys, enabling authentication and facilitating interactions among systems and services, which are essential for every API call, database query, or storage account access. As we depend on multi-factor authentication and passwords to safeguard human identities, a pressing question arises: How do we guarantee the security and integrity of these non-human counterparts? How do we authenticate, authorize, and regulate access for entities devoid of life but crucial for the functioning of critical systems? Let's break it down. The challenge Imagine a cloud-native application as a bustling metropolis of tiny neighborhoods known as microservices, all neatly packed into containers. These microservices function akin to diligent worker bees, each diligently performing its designated task, be it processing data, verifying credentials, or

Trojan.Milicenso - Printer Trojan cause massive printing A Trojan that sends printers crazy, making them print pages of garbled nonsense until all the paper has been used up, has seen a spike in activity.Symantec detected the Trojan.Milicenso across various countries, but the worst hit regions were the US and India followed by regions in South America and Europe, including the UK. According to a blog post published Thursday by researchers from antivirus provider Symantec, Dubbed " Trojan.Milicenso " it has been described by security researchers as a malware delivery vehicle "for hire" through its repeated use since it was first discovered in 2010. The Milicenso Trojan is actually a backdoor that is used to deliver other malware on the affected machines. The infection vectors are links and malicious attachments in unsolicited emails, as well as websites hosting malicious scripts that trigger the download of the Trojan. " Depending on the configuration, any files, including binary

Fujitsu cracks 278-digit crypto in 148 Days using 21 PCs A team of researchers in Japan have successfully broken a 278-digit piece of crypto in less than 200 days. Fujitsu Laboratories Limited , National Institute of Information and Communications Technology (NICT) and Kyushu University jointly broke a world cryptography record with the successful cryptanalysis of a 278-digit (923-bit)-long pairing-based cryptography, which is now becoming the next generation cryptography standard. " We were able to overcome this problem by making good use of various new technologies, that is, a technique optimising parameter setting that uses computer algebra, a two dimensional search algorithm extended from the linear search, and by using our efficient programing techniques to calculate a solution of an equation from a huge number of data, as well as the parallel programming technology that maximises computer power ." This doesn't mean that pairing-based cryptography, which is rapid

Call for Articles - July Edition | The Hacker News Monthly Magazine Attention Readers!! We know there is a writer in all of you and we invite you to submit your best work on the subject of BOTNETS for our July The Hacker News Monthly Magazine . Give us all your expertise and knowledge on the subject and we will give it a top priority! We'd like to thank our readers and supporters and know that we take your loyalty seriously and with great appreciation. See you in July! Ann Smith Executive Editor, The Hacker News

Indian ISPs get court relief, Torrent Sites Unblocked After weeks of confusion and frustration with blocked websites, the mess finally looks to be clearing. Indians are all heaving a sigh of relief because their ISPs have unblocked the access to the file-sharing, video-streaming BitTorrent sites that include The Pirate Bay, Torrentz.eu, Vimeo among others. It was in news last month that following Reliance, Airtel had also blocked torrent services and video sites after they received the 'John Doe' court order. Thousands of users from various states of India found the access to torrents blocked. India's Medianama is reporting today that the Madras High Court recently limited a badly drafted April ruling on the subject. The court said in its updated ruling, according to Medianama, which obtained a copy of it, that " the interim injunction is granted only in respect of a particular URL where the infringing movie is kept and not in respect of the entire website. Further, the a

Intel CPU Vulnerability can provide control of your system to attacker The U.S. Computer Emergency Readiness Team (US-CERT) has disclosed a flaw in Intel chips that could allow hackers to gain control of Windows and other operating systems. The flaw has already been exploited on 64-bit versions of Microsoft Windows 7, FreeBSD, NetBSD and there's a chance Apple's OS X may also be vulnerable. The flaw was disclosed the vulnerability in a security advisory released this week. Attackers could execute malicious code via kernel privileges or launch a local privilege escalation attack.  VMware's virtualization software is not affected, and neither are AMD's processors, as they do not use the SYSRET instruction whose incorrect handling causes the flaw or handle it differently.Many of the affected vendors have already pushed out an update that defuses the flaw. However, it said that while 32-bit operating systems are safe, " Intel CPUs that use the Intel 64 extension need th