#1 Trusted Cybersecurity News Platform Followed by 4.50+ million
The Hacker News Logo
Subscribe – Get Latest News
SaaS Security

The Hacker News | #1 Trusted Cybersecurity News Site — Index Page

Microsoft discontinues MD5 crypto for digital certificates to improve RDP Authentication

Microsoft discontinues MD5 crypto for digital certificates to improve RDP Authentication

Aug 15, 2013
This week Microsoft has released several advisories to help their users update from weak crypto. Microsoft is beginning the process of discontinuing support for digital certificates that use the MD5 hashing algorithm and to improve the network-level authentication for the Remote Desktop Protocol . Microsoft's optional updates : Microsoft Security Advisory 2661254: The private keys used in these certificates can be derived and could allow an attacker to duplicate the certificates and use them fraudulently to spoof content, perform phishing attacks, or perform man-in-the-middle attacks . Microsoft Security Advisory 2862973: Microsoft is announcing the availability of an update for supported editions of Windows Vista, Windows Server 2008, Windows 7 , Windows Server 2008 R2, Windows 8, Windows Server 2012, and Windows RT that restricts the use of certificates with MD5 hashes. This restriction is limited to certificates issued under roots in the Microsoft root certificate
New Police Ransomware 'Browlock' targeting users in US, Canada and UK

New Police Ransomware 'Browlock' targeting users in US, Canada and UK

Aug 15, 2013
What would you do if a European Cybercrime Agency locked your PC until you paid a fine? A new Police Ransomware  family dubbed Trojan : HTML/Browlock by F-secure Antivirus firm, known as Browlock , which spreads by tricking unsuspecting web surfers into believing the police are after them. Ransomware is malware that, when installed on a device, can be locked down from remote locations by cyber criminals . Usually, ransomware appears to be an official warning telling the user that the computer has to be locked because it showed illegal activities and payment is necessary to access files. Ransomware is a global phenomenon, but the criminals have learned to localize and customize their software to make the threat seem scarier so that victims act quickly before they have time to think. Researchers said they are tracking this Malware from a while ago and now crooks behind the malware ate targeting users from some new countries including the United States, Canada and th
How to Accelerate Vendor Risk Assessments in the Age of SaaS Sprawl

How to Accelerate Vendor Risk Assessments in the Age of SaaS Sprawl

Mar 21, 2024SaaS Security / Endpoint Security
In today's digital-first business environment dominated by SaaS applications, organizations increasingly depend on third-party vendors for essential cloud services and software solutions. As more vendors and services are added to the mix, the complexity and potential vulnerabilities within the  SaaS supply chain  snowball quickly. That's why effective vendor risk management (VRM) is a critical strategy in identifying, assessing, and mitigating risks to protect organizational assets and data integrity. Meanwhile, common approaches to vendor risk assessments are too slow and static for the modern world of SaaS. Most organizations have simply adapted their legacy evaluation techniques for on-premise software to apply to SaaS providers. This not only creates massive bottlenecks, but also causes organizations to inadvertently accept far too much risk. To effectively adapt to the realities of modern work, two major aspects need to change: the timeline of initial assessment must shorte
Thousands of Israeli websites hacked by Pakistani hackers for Palestine supports

Thousands of Israeli websites hacked by Pakistani hackers for Palestine supports

Aug 14, 2013
A cyber attack campaign  is ongoing and targeting thousands of Israeli websites by Pakistani hackers, in support of  Palestine people. They had already infiltrated reportedly 650 Israel  websites listen on Pastebin and upload their page with custom messages on servers. The hacker claimed and told 'The Hacker News' that they will release more hacked websites list soon. The hacker behind the massive attack mentioned his online name as " H4x0r HuSsY " and the message says, " LONG LIVE PALESTINE - PAKISTAN ZINDABAD HAPPY INDEPENDENCE DAY TO & FROM TEAM MADLEETS ". Hacked websites belong to Semi-Government, Personal and Israeli Corporates. At the time of writing, most of the websites still having deface page uploaded to their server. A few months back World wide Hackers and especially Anonymous group declared massive 'cyber war' on Israel after IDF threatens to cut off internet in Gaza.
cyber security

Automated remediation solutions are crucial for security

websiteWing SecurityShadow IT / SaaS Security
Especially when it comes to securing employees' SaaS usage, don't settle for a longer to-do list. Auto-remediation is key to achieving SaaS security.
Microsoft Patch Tuesday to Fix Three Critical Remote Code Execution vulnerabilities

Microsoft Patch Tuesday to Fix Three Critical Remote Code Execution vulnerabilities

Aug 13, 2013
Yeah, it's Patch Tuesday once again. Almost 10 years ago in October, 2003 - Microsoft  invented the process of regularly scheduled security updates on every second Tuesday of the Month, as  Patch Tuesday. Today, the Microsoft Security team will i ssue eight security updates in total, out of that -- three of which are designated as " critical ," and rest five as " Important " updates, that patches vulnerabilities in Microsoft Windows, Microsoft Server Software, and Internet Explorer. The eight bulletins that Microsoft is releasing fixes a total of 23 different vulnerabilities in Microsoft products. Microsoft will be rolling out a total of three Critical patches dealing with Remote Code Execution. Windows 8 is expected to get four of the updates, one of them is critical and dealing with Remote Code Execution with Internet Explorer 10, while the other three updates are Important and deal with Elevation of Privilege and Denial of Service . Windows RT i
Pakistani hackers hit Indian Eastern Railways Website just before Independence day

Pakistani hackers hit Indian Eastern Railways Website just before Independence day

Aug 13, 2013
Just four days before the Independence day, The Pakistani hacker known as 'MindCracker' from Pakistan Cyber Army team hacked into the Indian Eastern Railways website and deface some internal pages, as shown in the screenshot taken by us few hours before. At the time of reporting, website ( https://www.er.indianrailways.gov.in/ ) was restored by the administrator. Other members of Team of the hackers behind the scene mentioned their digital name on deface page as, " We Are : Shadow008 | KhantastiC | Darksnipper | H4x0rL1f3 | Invectus ". They seem to have gained access to some part of the website, because homepage was not altered in any way.  Zone-H mirror record of the defacement is also available. A few days ago an Indian hacker 'Godzilla' hacked into the Pakistan Army website and few related Facebook pages. This hack appears as revenge hack against action of Indian hackers.
Warning: Android Bitcoin wallet apps vulnerable to theft

Warning: Android Bitcoin wallet apps vulnerable to theft

Aug 13, 2013
A critical vulnerability in the Android implementation of the Java SecureRandom random number generator was discovered , that leaves Bitcoin digital wallets on the mobile platform vulnerable to theft. Before the announcement was made, users on the forums had noticed over 55 BTC were stolen a few hours after the client improperly signed a transaction using the compromised random number generator. Bitcoin is a virtual currency that makes use of cryptography to create and transfer bitcoins. Users make use of digital wallets to store bitcoin addresses from which bitcoins are received or sent. Bitcoin uses public-key cryptography so that each address is associated with a pair of mathematically linked public and private keys that are held in the wallet. Because the problem is rooted in the operating system, every Bitcoin digital wallet generated by an Android app is affected by the weakness, including Bitcoin Wallet , blockchain.info wallet , Bitcoin Spinner , and Myc
Criminals rapidly migrating to new digital Currency 'Perfect Money' after Liberty Reserve takedown

Criminals rapidly migrating to new digital Currency 'Perfect Money' after Liberty Reserve takedown

Aug 12, 2013
There are so many ways to move money anonymously on the Internet and US Justice Department has declared war on currencies widely used by cyber criminals . Just after the Law Enforcement in 17 countries shuts down ' Liberty Reserve ', a $6 billion digital money laundering operation, now the criminals is switching to another online currency called " Perfect Money ".  Perfect Money, another private digital currency that has emerged to meet the demand of Criminals and hackers, those buying and selling kit anonymously and being used by people selling stolen credit cards in Internet hacker forums recently. Fraudsters are rapidly migrating to Perfect Money and  it allows users to transfer money anonymously by purchasing and exchanging the proprietary currency for dollars, euros and gold. These virtual currencies are often linked to bitcoin because it has also been used by criminals. It was thought Bitcoin would be a handy replacement for Liberty Reser
On 10th Anniversary 'The Pirate Bay' Releases Its Own uncensored Web Browser 'PirateBrowser'

On 10th Anniversary 'The Pirate Bay' Releases Its Own uncensored Web Browser 'PirateBrowser'

Aug 10, 2013
No matter how much effort an ISP puts in or the government does, censorship always gets a backdoor . One of the biggest Controversial File Sharing site ' The Pirate Bay ' is censored in various capacities in some countries around the world, but Pirate Bay is celebrating its 10th birthday in Stockholm sponsored by an energy drinks maker. On their 10th anniversary the site is releasing its " Pirate Browser ," a custom Firefox browser that skirts Internet censorship and lets you access the Pirate Bay from anywhere.  However, Its founders recently served jail time for their activities, with one of the founders going back to prison in an unrelated Swedish hacking case. PirateBrowser is meant to focus more on unrestricted access to the Internet than it is about being able to download new episode of Breaking Bad without paying for them, but one tends to be a function of the other. According to the Pirate Browser website, It's a customized Firefox 23 and inclu
Several Malicious Android apps found on Google Play affects 25,000 devices

Several Malicious Android apps found on Google Play affects 25,000 devices

Aug 10, 2013
As time goes on, though, the Malware Risk on Mobile Platforms appears to be increasing. A flood of scammy apps that are difficult for Google to detect, and therefore stays available for download for several days before being removed. The Russia-based firm Dr Web today said it has discovered several malicious  Android apps found on Google Play  which send SMS to premium numbers and  about 25,000 devices are infected by these malwares . A number of malicious programs have been discovered by Dr Web's analysts belong to the Vietnamese developer AppStoreJsc . These programs are published in the form of audio players and a video player that generally display adult content. Dr Web explains, " While running these carrier applications, dubbed Android . MulDrop, Android.MulDrop.1, and Android.MulDrop.2 by Dr . Web, can prompt the user to download the content they need, but their consent initiates the installation of another application rather than the downloadin
LulzSec hacker sentenced to 1 year jail & ordered to pay $605,663 in restitution

LulzSec hacker sentenced to 1 year jail & ordered to pay $605,663 in restitution

Aug 09, 2013
A second member of hacking group LulzSec - Raynaldo Rivera, 21, of Tempe, Arizona, has been sentenced to 1 year in prison, 13 months of house arrest, and 1,000 hours of community service for hacking into the computers of Sony Pictures Entertainment . Raynaldo who went by Internet names " neuron " was member of LulzSec Hacking Team in an attack on Sony Pictures which saw personal data belonging to 138,000 customers leaked. He's also been ordered to pay $605,663 in restitution.  The attackers distributed the stolen data on the Internet, information that included names, addresses, phone numbers and e-mail addresses for tens of thousands of Sony customers. Raynaldo also pleaded guilty to obtaining confidential information from various companies and posting it publicly. Another member of LulzSec ' Cody Andrew Kretsinger ' was given a one-year jail sentence back in April. Rivera and Kretsinger both studied at the University of Advancing Technology in Tempe
Cybersecurity Resources