The Hacker News | #1 Trusted Cybersecurity News Site — Index Page

It is that time of year which everybody loves. It is the holiday season and you will start to see a lot more people express good attitudes and wish everyone else a happy new year. As a matter of fact it may be hard to think that with all of this much goodwill in the air there is someone out there who is trying to take advantage of that. But the fact is no matter what time of year it is there are always going to be bad guys around every corner and they will try to stalk their prey at anytime. It does not matter what time of year it is, the bad guys like to work all year round and you always have to be on the lookout for them. As a matter of fact this time of year is a very good time when it comes to black hat hackers . This is because there are so many people online around this time and they are looking for a bunch of deals for their Christmas shopping. The retailers really go full throttle around this time of year and they want to be able to make as much money as they can. This t

Ask an expert on cyber espionage and he for sure he will speak of China, the most active and advanced country in this sector, this time a clamorous campaign apparently originated from Korea has been discovered. Security company FireEye collected evidences of a cyber espionage campaign, named " Sanny ", attributable to Korea. FireEye hasn't revealed the real origin of the offensive, it's a mystery which Korea is responsible between North or South Korea, but it confirmed that 80% of victims are Russian organizations and companies belonging to space research industry, information, education and telecommunication. According Ali Islam, security researcher at FireEye declared " Though we don't have full concrete evidence, we have identified many indicators leading to Korea as a possible origin of attack."   The following are the indicators we have so far: 1. The SMTP mail server and CnC are in Korea 2. The fonts "Batang" and "KP CheongPong" used in the

It comes as no surprise that today's cyber threats are orders of magnitude more complex than those of the past. And the ever-evolving tactics that attackers use demand the adoption of better, more holistic and consolidated ways to meet this non-stop challenge. Security teams constantly look for ways to reduce risk while improving security posture, but many approaches offer piecemeal solutions – zeroing in on one particular element of the evolving threat landscape challenge – missing the forest for the trees.  In the last few years, Exposure Management has become known as a comprehensive way of reigning in the chaos, giving organizations a true fighting chance to reduce risk and improve posture. In this article I'll cover what Exposure Management is, how it stacks up against some alternative approaches and why building an Exposure Management program should be on  your 2024 to-do list. What is Exposure Management?  Exposure Management is the systematic identification, evaluation,

A user over at the XDA Developers Forum has gone searching through Samsung Exynos kernels and has found one whopper of an exploit. There's both good and bad news with this exploit so head down below for more details on this new found glory. This exploits affects a number of Samsung-made devices, along with potentially any device using an Exynos 4412 or 4210 processor and Samsung kernels. The vulnerability was described on Saturday by the user " alephzain " on XDA Developers, a forum for mobile developers. This Vulnerability could give remotely downloaded apps the ability to read user data, brick phones, or perform other malicious activities. This functionality can be exploited by some malicious apps to gain root access to the device, wipe/steal sensitive data, install malicious codes, and could also be used to potentially brick the phone. According to xda-developers user supercurio, Samsung has been made aware of the security hole, but the company has not p

This Morning Anonymous member with twitter handle @OsamaTheGod leaked a huge database from server of Israeli Musical Act Magazine (act.co.il). The leaked database posted on public note website and includes users ID, username, password in clear text, IP address and phone numbers. Hacker posted data of about 10000 users from the site. Reason of hack yet not mentioned anywhere, but because hacker use #OpIsrael hash in his tweets, so this could be an attack against Israel in fight of Anonymous vs Israel. Stay tuned for further update.

In November I was contacted for first time by the Egyptian Hacker named ViruS_HimA who announced me to have hacked into Adobe servers and leaked private data. The hacker violated Adobe servers gaining full access and dumping the entire database with more of 150,000 emails and hashed passwords of Adobe employees and customers/partner of the firm such as US Military, USAF, Google, Nasa DHL and many other companies. ViruS_HimA specifically addressed the inefficient and slow patch management process that leaves exposed for long period "big companies".  " When someone report vulnerability to them, It take 5-7 days for the notification that they've received your report!! It even takes 3-4 months to patch the vulnerabilities! Such big companies should really respond very fast and fix the security issues as fast as they can ." Like , we reported two days before that one month old reported critical vulnerability of account hijacking in Outlook and Hotmail  is still wo

Mohamed Ramadan from Attack-Secure discovered a critical vulnerability in Etsy's iPhone application. Etsy is a social commerce website focused on handmade or vintage items as well as art and craft supplies. Any attacker on the same network can sniff traffic (including user password) invisibly without any warning from Etsy app. Its is very similar to the man in the middle attack reported in iPhone Instagram app a few days back. Bug Hunting ! Because Etsy having a Security Bug Bounty Program , so first Mohamed was trying to find a vulnerability in Etsy website , later he found that they have enough good security. Because Etsy mobile apps are eligible in bug bounty program, so next try was on Mobile apps. Mohamed finally  downloaded the latest version 2.2 and installed that on his iPhone 4S with iOS 6 and also on his ipad. Then he configured his Burp Suite proxy 1.5 to listen on all interfaces on port 8080 in invisible mode.  He disabled any firewall and con

Cui, a fifth year grad student from the Columbia University Intrusion Detection Systems Lab and co-founder of Red Balloon Security, has demonstrated an attack on common Cisco-branded Voice over IP (VoIP) phones that could easily eavesdrop on private conversations remotely. The vulnerability Cui demonstrated was based on work he did over the last year on what he called ' Project Gunman v2 ', where a laser printer firmware update could be compromised to include additional, and potentially malicious, code. The latest vulnerability is based on a lack of input validation at the syscall interface. Cui said, " allows arbitrary modification of kernel memory from userland, as well as arbitrary code execution within the kernel. This, in turn, allows the attacker to become root, gain control over the DSP , buttons, and LEDs on the phone. " While he did not specify the precise vulnerability, Cui said it allowed him to patch the phone's software with arbitrary pieces of code, and that this a

A vulnerability in different versions of Microsoft's widely used browser Internet Explorer can allow hackers to track the movements of your mouse. Microsoft is investigating reports of a mouse-tracking flaw that puts virtual keyboards and keypads at risk to remote monitoring. Spider.io, a UK-based company in the advertising analytics field, alleged that two unnamed companies are improperly using a flaw that allows them to track whether display advertisements, sometimes buried far down in web pages, are actually viewed by users. Almost every US-based user of Internet Explorer will have their mouse cursor tracked via this exploit almost every day they browse the web. Microsoft has confirmed that every version of Internet Explorer, from version 6 dating back to 2001 up to 10, released this year, is vulnerable. How this works ? All a hacker needs to do is, buy a ad space on any webpage and wait until a user visits it. If the tab remains open, the hacker has continuous access to user

This Friday I was working with my co-security researcher " Christy Philip Mathew " in +The Hacker News  Lab for testing the Cookie Handling Vulnerabilities in the most famous email services i.e Hotmail and Outlook. Well, both are merged now and part of the same parent company - Microsoft, the software giant.  Vulnerability allows an attacker to Hijack accounts in a very simple way, by just exporting & importing cookies of an user account from one system to attacker's system, and our results shows that even after logout by victim, the attacker is still able to reuse cookies at his end. There are different way of stealing cookies, that we will discuss below. In May 2012, another Indian security researcher Rishi Narang claimed similar vulnerability in Linkedin website. Vulnerability Details Many websites including Microsoft services uses cookies to store the session information in the user's web browser. Cookies are responsible for maintainin

A former University of Georgia (UGA) student under investigation for allegedly hacking into the school's computerized personnel records system committed suicide last month. Stell attended classes at UGA between 2005 and 2007. The Data breach was carried out around two months back near 15th October and that may have led to compromised Full names and Social Security numbers, along with additional sensitive data of 8,500 current and former school employees. According to reports , an investigation into the security breach was ongoing when the suspect, Charles Staples Stell , 26, was found dead at his home in Athens on Nov. 7. The UGA Police Department's computer forensics team was investigating the hack. They said, There is no evidence that the compromised data were used to commit additional crimes. The employee files involved in the security breach were found under the control of Stell during the ensuing forensic evaluation of evidence obtained during the course of the investigati

Japan's National Police Agency has offered a monetary reward for a wanted hacker, use programming languages like C# to create a virus called " iesys.exe " and Hijack systems of innocent people to post aggressive messages on Internet on behalf of Users.  Method called a " Syberian Post Office " to post messages to popular Japanese bulletin board. Hacker use cross-site request forgery exploit, that allow hackers to making online postings via innocent users automatically. The messages included warnings of plans for mass killings at an elementary school posted to a city website. It is the first time that Japan's National Police Agency has offered a monetary reward for a wanted hacker  and will pay up to 3 million yen (US$36,000). The case is an embarrassing one for the police, in which earlier this year four individuals were wrongly arrested after their PCs were hacked and used to post  such messages on public bulletin boards. " Up until now th

The Homepage of BSNL ( Bharat Sanchar Nigam Limited ) https://www.bsnl.co.in/ was hacked today morning by hacking group Anonymous.  BSNL is an Indian state-owned telecommunications company, the largest provider of fixed telephony and fourth largest mobile telephony provider in India, and is also a provider of broadband services. The website's homepage was hacked saying, "  Hacked by Anonymous India,  support Aseem trivedi (cartoonist) and alok dixit on the hunger strike,  remove IT Act 66a,  databases of all 250 bsnl site has been deleted .............Do not think of BACKUP "  with a images of Mr. Aseem while he was arrested by Police. Hack was performed by Anonymous India hacking group and claiming to hack whole server, with 250 Databases. Hacker wrote on deface page, that they deleted all the databases and dump credentials of BSNL database servers in a pastebin File . Analyzing the dump of database After analyzing the dump of database login informat

The U.S. Department of Justice said on Tuesday that they've arrested 10 suspects from from Bosnia and Herzegovina, Croatia, Macedonia, New Zealand, Peru, the United Kingdom, and the United States involved in a global botnet operation that infected more than 11 million systems. The ring is said to have caused more than $850m in losses in one of the largest cyber crime hauls in history. Officials said international cyber crime rings linked to Butterfly (aka Mariposa) botnet, first discovered in December 2008 and shut down a year later, infected over 12 million PCs worldwide and was spread primarily through file-sharing and instant messaging attacks. It also harvested financial information from over 800,000 victims. FBI said , " Facebook's security team provided assistance to law enforcement throughout the investigation by helping to identify the root cause, the perpetrators, and those affected by the malware. Yahos targeted Facebook users from 2010 to October 2012, and security sy

Some 22,300 purported student and staff records held by the Australian Defence Force Academy were stolen and published online last month. A member of the Anonymous group, known as Darwinaire , is claiming responsibility for the theft. The systems were compromised in November, with UNSW notifying staff and students within a day, but has only now come to light. Among the victims are hundreds of senior officers in the army, navy and air force, as well as military personnel from other nations who are enrolled at the academy. Hacker express the lack of security as '' I know, right, very surprised I didn't get kicked out. So simple, took like three minutes , ''. The University of Canberra in which the ADFA resides had warned students of possible phishing attacks but said the compromised passwords were mostly redundant.  Darwinare, who describes himself as ''black hacker'', has previously breached the networks of online bookstore Amazo

The Izz ad-Din al-Qassam Cyber Fighters published a new message on their Pastebin profile , warning of a new round of cyber attacks against U.S. financial institutions, beginning this week. In September and October , al-Qassam launched widespread distributed denial-of-service (DDoS) attacks against numerous banking websites . A Bank of America spokesperson told that the bank is " aware of the reports of possible cyber attacks and [is] monitoring [its] systems, which are fully operational .". Hacker said in new warning note ," After stopping one month attack of Izz ad-Din al-Qassam Group to American banks, today, this group has announced a new cycle of attacks, via an Email which has been sent to us, and has acclaimed that its aim is to compensate guilty offends to holy Prophet of Islam, Mohammad(PBUH). Also, in internet conversations earlier, this group had been stated that these attacks won't stopped and even in new announcements, it's been marked that there will b

With the release of the Microsoft security bulletins for December 2012, Company flag total 7 updates for Windows users, where one is rated as critical that could lead to remote code execution, where as other two are rated as important which fix flaws that could result in the operating system's security features being bypassed. All of the IE fixes involve use-after-free memory vulnerabilities. Where as kernel level exploits bundled into mass-exploitation kits is like Blackhole. In addition to IE, Microsoft is fixing a critical flaw in Microsoft Word that could enable attackers to execute remote code. The vulnerability could be exploited by way of a malformed Rich Text Format (RTF) document. Also Fonts can also be used as a potential attack vector, as this Patch Tuesday reveals. A pair of critical font parsing vulnerabilities are being patched this month, one for OpenType and the other for TrueType fonts. Details of all Updates : MS12-077 – All versions of

ReVuln Ltd. , a small security company headed by Donato Ferrante and Luigi Auriemma, post a video that demonstrates that how attacks can gain root on the appliances. Samsung Smart TV contain a vulnerability which allows remote attackers to swipe data from attached storage devices. In this demonstration readers will see how it is possible to use a 0-day vulnerability to retrieve sensitive information, root access, and ultimately monitor and fully control the device remotely. Auriemma said, " We have tested different Samsung televisions of the latest generations running the latest version of their firmware.  Unfortunately we can't disclose additional information but we can only say that almost all the people having a Samsung TV at home or in their offices are affected by this vulnerability. ".

Saudi Arabia's national oil company " Aramco " is the country's largest oil production facility and is a significant exporter in the Organization of the Petroleum Exporting Countries. They said that a cyber attack against it in August which damaged some 30,000 computers was aimed at stopping oil and gas production at the biggest OPEC exporter. The interior ministry said it was carried out by organised hackers from several different foreign countries and Aramco employees and contractors were not involved. " The main target in this attack was to stop the flow of oil and gas to local and international markets and thank God they were not able to achieve their goals ," Abdullah al-Saadan, Aramco's vice president for corporate planning, said on Al Ekhbariya television. " Not a drop of oil was lost and the company was able to restore productivity in record time ," he added. The hackers used several methods to hide their location The attack used a computer viru

Team Ghostshell a Hacktivists group of hackers, who before was in news for hacking Major Universities Around The Globe and leaked 120,000 records, are once again hit major organisations and expose around 1.6 million accounts  Hacker name the project as #ProjectWhiteFox , means " Freedom of Information " . These leaked 1.6 millions user accounts belongs to aerospace, nanotechnology, banking, law, education, government, military, all kinds of wacky companies & corporations working for the department of defense, airlines and more. In a Pastebin Note hackers mention, " How we went from 'cyber-criminals' to 'hacktivists' to 'e-terrorists' to 'bad actors' to blacklisted. #ProjectHellFire got the US wary of us, at that time we still wasn't sure if GhostShell had gotten X'd, but when the second release of #ProjectWestWind came out, you guys got so hyped about it that we knew it had started to unfold. " Hacked

Anonymous hackers once again hit Egyptian Government Websites and taken down. Hackers react under operation named #OpEgypt and hit 30 websites with DDos attack. Hacktivist using the handle @AnonymousGrupo claimed the responsibility of attack. Attacked websites include, The Egyptian Presidency website, The Egyptian Cabinet, Trade Agreements Sector (TAS), Maritime Transport site, Central Agency for Public Mobilization and Statistics, parliament website, Income Tax and many more. At the time of writing, many sites has been restored, but a few like https://www.presidency.gov.eg/ is still under maintenance. The Reason of Hack is mentioned in the banner shown above, was posted their facebook page. Readers can find list of sites under attack at Pastebin Note here .