The Hacker News | #1 Trusted Cybersecurity News Site — Index Page

Anonymous claimed it had stolen and leaked over 2,000 usernames and passwords for Hill staffers in an anti- PRISM protest, calling the move a pivotal moment for Congress. The Twitter handle @OpLastResort which claims to be affiliated with the famous hacktivist group posted the data and also tweeted: " We mean it. This is a pivotal moment for America, and we will not tolerate failure ." Congress actually fosters decent password best practices, requiring a special character, an uppercase letter, a lowercase letter, and a number to make up a code between 6-10 characters. What is perhaps most interesting about the hacked passwords is that they exemplify, in many cases they are just dictionary words with numbers tacked on to the end, the names of the staffers' bosses, or their favorite sports team, so the claimed hack and leaked database was probably outdated or fake. But the security advisory that was sent out to staffers said, "Early today, hackers disclo

Google being one of the top web based service provider, has huge number of Internet users availing the free and paid services for their day-to-day personal and/or professional needs. Many of them have configured their mobile phone number for their account password recovery options. Certainly, when comes the mobility, many of these users prefer Google's android based smart phones and tablets to access these services anytime, anywhere. In case of issues in accessing GMAIL services, user is been provided with the option to reset the account password by simply asking Google to send a verification code on the pre-registered mobile number. On the other hand, Android (mobile operating system from Google) based devices are bundled with security features to keep the privacy of user data/information intact. The user can opt to set the security level from none to Password (High), this ensures that, to access the mobile device and information within it, the user needs to pass through

It comes as no surprise that today's cyber threats are orders of magnitude more complex than those of the past. And the ever-evolving tactics that attackers use demand the adoption of better, more holistic and consolidated ways to meet this non-stop challenge. Security teams constantly look for ways to reduce risk while improving security posture, but many approaches offer piecemeal solutions – zeroing in on one particular element of the evolving threat landscape challenge – missing the forest for the trees.  In the last few years, Exposure Management has become known as a comprehensive way of reigning in the chaos, giving organizations a true fighting chance to reduce risk and improve posture. In this article I'll cover what Exposure Management is, how it stacks up against some alternative approaches and why building an Exposure Management program should be on  your 2024 to-do list. What is Exposure Management?  Exposure Management is the systematic identification, evaluation,

Privacy protection in the services we use on a daily basis has been a big topic of conversation following accusations that Google, Microsoft, Apple and other large tech companies were working with government agencies to provide user data. According to a new report by CNet , Google may introduce encryption for users' data generated on their Google Drive to protect its customers' privacy against attempts by the U.S. government to access the data. Why Encryption ?  Secure encryption of users' private files means that Google would not be able to divulge the contents of stored communications even if NSA submitted a legal order under the Foreign Intelligence Surveillance Act or if police obtained a search warrant for domestic law enforcement purposes. "Mechanisms like this could give people more confidence and allow them to start backing up potentially their whole device, " said Seth Schoen, Electronic Frontier Foundation. Many companies use SSL and HTTPS to secu

Anonymous hackers claimed yesterday that they have broken into a server used by the Federal Emergency Management Agency (FEMA) and leaked the database  ( password : fema ) includes - names, addresses and other information of FEMA contractors, private defense contractors, federal agents and local authorities. Hack was performed in response to Homeland Security training exercises that centered on a fictional version of the hacker collective.FEMA, under the Department of Homeland Security, conducts an National Level Exercise (NLE) each year. " This is a message from some of us, to FEMA, to various world governments and to their complicit corporate lackeys who dwell in the shadows as well as to the 2.5 billion regular people who use the internet and have found that their right to privacy has been utterly destroyed. " hackers said. The dump contains a table of user IDs and MD5 hashes of corresponding passwords and leaked mailing addresses connected to some of the

Tumblr posted a blog post Tuesday night warning users to change their passwords and released a very important security update for iOS users after identifying a breach that compromised their passwords. It seems that, under certain circumstances, the prior versions of the iPhone and iPad apps would allow an individual with malicious intent to sniff or intercept passwords as they are in transit across a local network. The problem arose because the iPad and iPhone apps fail to log users in through a secure server.  The vulnerability does not seem to have affected Tumblr's Android app. The company urged users to download the latest version of the Tumblr app, which is available in the Apple iTunes Store. The company did not provide further details on the breach. It's also good practice to use different passwords across different services by using an app like 1Password or LastPass. It doesn't appear that any passwords got in the hands of malicious individuals, though you

Recent disclosures by whistleblower Edward Snowden claiming that internet traffic is being intercepted and used by the Americans in their war on terror, force to re-think about the user's privacy and online anonymity. It has been relatively common knowledge for years that wherever we go on the web, we leave clear tracks, so it shouldn't really have come as much of a surprise to discover this has been going on. The best thing you can do to stay anonymous online is to hide your IP address . If someone knows your IP address, it is the easiest way to trace your online activity back to you and they can easily determine the geographic location of the server that hosts that address and get a rough idea of where you're located. TOR is a network of virtual tunnels that allows people and groups to improve their privacy and security on the Internet. Browsing with TOR is a lot like simultaneously using hundreds of different proxies that are randomized periodically.

TrueCaller, a popular app built by a Swedish company and world's largest collaborative phone directory compromised by Syrian Electronic Army hackers. Truecaller was running an outdated version (3.5.1) of blogging software WordPress for its web interface and there are millions of Phonebook records available in their database that were reportedly stolen by hackers, as claimed on their twitter account. Syrian Electronic Army also claimed that the database contains million of access codes of Facebook, Twitter, Linkedin, Gmail Accounts of different users, that can be used to post update from compromised Accounts. In total, the hackers claimed to downloaded more than 7 databases fro Truecaller server of 450GB in size. At the time of reporting this news, Truecaller website is still under maintenance and index page saying, " We are doing some upgrades. Thank you for your patience ." SEA also posted a database screenshot on twitter, showing the phonebook l

Researchers at mobile security firm Lookout discovered a security flaw in Google Glass which allowed them to capture data without the user's knowledge, when the user merely took a photo that captured a malicious QR code. Lookout was able to force Google Glass to silently connect to a Wi-Fi access point, which let the researchers view all of the data flowing to and from the device. When combined with an Android 4.0.4 web vulnerability , the hack apparently gave researchers full control of the Glass headset. The problem was that Google Glass could be told to execute a QR code without the user having to give permission. Because of Glass's limited user interface, Google set up the device's camera to automatically process any QR code in a photograph. In a video posted on YouTube, Lookout Security described the vulnerability: " That access point in turn allowed us to spy on the connections Glass made, from web requests to images uploaded to the Cloud ." said Mar

Android Security Squad, the China-based group that  uncovered a second Android master key vulnerability that might be abused to modify smartphone apps without breaking their digital signatures.  The whole point of digitally signing a document or file is to prove the file hasn't been modified. The process uses a form of public-key cryptography . In Chinese version of hacking attack, malicious code can be added into the file headers, but the method is limited because targeted files need to be smaller than 64K in size. APK files are packed using a version of the widespread ZIP archiving algorithm. Most ZIP implementations won't permit two same-named files in one archive, but the algorithm itself doesn't forbid that possibility. So basically, two versions of the classes.dex file are placed inside of the package, the original and a hacked alternative. When checking an app's digital signature, the Android OS looks at the first matching file, but when act

Ransomware is a type of malware that attempts to extort money from a computer user by infecting and taking control of the victim's machine, or the files or documents stored on it. This kind of malware has typically been the domain of Windows users, but has made its way to OS X. A new piece of FBI themed Ransomware Malware is targeting Mac OS X and hijacking the user's browser with a notice demanding payment of $300 in order to release control of the application and accusing them of illegally accessing pornography. The address bar shows a URL clearly trying to fool users - fbi.gov.id657546456-3999456674.k8381.com  and the warnings appearing to be from the FBI tell the victim: " you have been viewing or distributing prohibited Pornographic content.. To unlock your computer and to avoid other legal consequences, you are obligated to pay a release fee of $300. " According to Malwarebytes , ransomware page is being pushed onto unsuspecting users browsing re

There's a scam spreading through Twitter Direct messages (DMs) and fake emails, appealing users to visit a fake twitter phishing site i.e " twittler.com ". Scam uses a hijacked Twitter account to send out direct messages that appear completely legitimate. Security blogger, Janne Ahlberg blogged about this new phishing scam, " This is a nasty trick especially when the sender is someone you know and trust. If you receive a suspicious DM or email from a person you know and trust, just warn him/her – the account is most likely hijacked and controlled by the attackers. " The webpage resembles a Twitter login page and is trying to obtain your Twitter login credentials with a domain name looks very similar to original Twitter.com , with two extra word "LL" in it.   To play it safe, double-check your browser address bar to make sure that's where you are on orginal website  twitter.com before logging in. If you enter your Twitter usern

Edward Snowden has helped to make the world a little bit better and safer. A Swedish professor of sociology has nominated NSA whistleblower Edward Snowden for the 2014 Nobel Peace Prize. In his letter addressed to the Norwegian Nobel Committee, sociology professor Stefan Svallfors recommended the Snowden be a candidate, for his " heroic effort at a great personal cost " shedding light on the expansive cyber-spying conducted by the NSA . A nomination for Snowden would be symbolic because it shows ' that individuals can stand up for fundamental rights and freedoms .' he said. But it may be too late for Snowden to receive the award this year, so he will not be eligible for this year's prize, which will be awarded in December, but could be considered for 2014. The head of the International Committee of the Russian State Duma Aleksey Pushkov tweeted, " Not in a million years will the United States allow Snowden to get the Peace Prize. But h

You've got to ask yourself one question. How much hassle does patching cause you? Is the second Tuesday of each month something you dread, or is it just another day for you? If you spend days and days testing and deploying patches; if you stay up until the wee hours of the morning one weekend each month; if you have a current profile on every single server in your environment; then patching is likely to be a heavy burden. But there is another way. Patching is not something that should be a major pain each month. It should be a simple and straightforward administrative task. Admins who patch by hand or are worried about some patch crashing critical systems each month should consider automated patch management. This strategy will boost efficiency and give you back your weekends, and ensure that your systems can be patched quickly, efficiently and safely. Automated patch management helps IT admins patch their servers and workstations in the most efficient way possible, by removi

Edward Snowden has enough information to cause more damage to the US government in a minute alone than anyone else has ever had in the history of the United States, but he has insisted that they not be made public, including  the blueprints of NSA surveillance program . Glenn Greenwald, the Guardian journalist, who was the first to report on classified documents leaked by Edward Snowden, says the former National Security Agency contractor has what amounts to an " instruction manual for how the NSA is built. " The documents " would allow somebody who read them to know exactly how the NSA does what it does, which would in turn allow them to evade that surveillance or replicate it ," Greenwald said.  " In order to take documents with him that proved that what he was saying was true he had to take ones that included very sensitive, detailed blueprints of how the NSA does what they do. " Greenwald said that Snowden is planning more stories on domestic spying

A group of  hackers from security firm iSEC found a way to tap right into verizon wireless cell phones using a signal-boosting devices made by Samsung for Verizon and cost about $250. They hack Verizon's signal-boosting devices, known as femtocells or network extenders, which anyone can buy online, and turned it into a cell phone tower small enough to fit inside a backpack capable of capturing and intercepting all calls, text messages and data sent by mobile devices within range. " This is not about how the NSA would attack ordinary people. This is about how ordinary people would attack ordinary people, " said Tom Ritter, a senior consultant, iSEC. They declined to disclose how they had modified the software on the device and but they plan to give more elaborate demonstrations in various hacking conferences this year. Verizon Wireless already released a Linux software update in March to fix the flaw that prevents its network extenders

Security expert Dan Melamed discovered a critical vulnerability in Facebook platform that allow an attacker to take complete control over any account. The vulnerability is considered critical because it would allow a hacker to hack potentially any Facebook account. Dan Melamed presented the discovery on his blog . Dan demonstrated that how a hacker can reset the victim's account password just by tricking him to visit a malicious exploit code. The flaw affects the Facebook " claim email address " component. When an user tries to add an email address already registered to Facebook platform, he has the option to " claim it ". The loophole exists here, when user claim an email address, Facebook did not check from whom the request came from. This allows an email to be claimed on any Facebook account. The exploit is possible provided that: An existing account having the email address that the attacker wants to claim. Another existing account to initiate the claim p

" Ransomware " may be a term you haven't heard before. This type of criminal malware, which spread around the world on PCs in 2012, encrypts some or all the files on a computer and holds them for ransom and  Cyber thieves have already made millions through such methods. Ransomware is no longer all about computers. It has evolved to now target mobile devices, specifically Androids platform. For a hacker, a pop up message is just one more way to steal money by sending fake alerts and serious warnings that scare a user into making a payment. For example, in the case of PCs, we have encountered malware that encrypts crucial data on a user's hard disk, asking the victim to pay a sum to the attacker in order to recover his/her data. Last year in November at many Hacking Conferences, Security Researcher Mohit Kumar ( @Unix_Root ) already demonstrated one the most sophisticated android malware called " Android Malware Engine ", one of its kind yet

According to a secret agreement it signed in 2001 with the FBI and US Department of Justice - Telstra, Australia's largest phone company is storing huge volumes of electronic communications it carried between Asia and the US for potential surveillance by US intelligence agencies. The contract was prompted by Telstra's undersea telecommunications joint venture called Reach . Undersea cabling " physically located in the United States, from which Electronic Surveillance can be conducted pursuant to Lawful US Process. " The document also specifies the facility should be run exclusively by US staff.  The document was signed by Douglas Gration, a barrister who was then Telstra's company secretary and official liaison for law enforcement and national security agencies. The venture also guaranteed it would be able to provide U.S. authorities with copies of stored data, call logs, subscriber information, and billing data, according to the document. Those were to be stor

Whistleblower Edward Snowden made a public appearance yesterday at a Moscow airport, beside a staff member of the Wikileaks organization, met with representatives of a half-dozen or so human rights groups. Snowden has not been seen in public and was stuck in the transit area of Moscow's Sheremetyevo Airport since arriving there on June 23 from Hong Kong . A 30 second video posted on youtube, which did not name the source for this clip. Notable because no press were permitted inside, and no video was allowed. Snowden said that he wants asylum in Russia before moving on to Latin America and assailing U.S. surveillance programs as illegal and immoral, but Immigration officials in Russia say they've not received any application from Edward Snowden . As Snowden explained it Friday, he disputes the notion that his actions are doing damage to the United States. As a result, Putin's condition doesn't apply. Snowden said that he has received offers of asylum

In 2010 the Indian authorities threatened to shut down BlackBerry's infrastructure unless it agreed to comply with lawful access requirements providing the government a way to intercept messages in order to prevent terrorist attacks. The long time dispute between the Indian government and BlackBerry over monitoring, tracking and interception is now resolved. Blackberry is ready to provide the Indian authorities with a way to lawful intercept consumers' messages sent and received on its platform including mails and peripherals, chats and browsing history on BlackBerry devices. But BlackBerry Enterprise Server has been left out of the interception solution which means corporate emails won't be under scrutiny. According to an internal document of the Department of Telecommunications (DoT), nine out of 10 telecom networks offering Blackberry services were in the process of making it possible for authorities to carry out intercepts. Blackberry train 5