#1 Trusted Cybersecurity News Platform Followed by 4.50+ million
The Hacker News Logo
Get the Free Newsletter
SaaS Security

The Hacker News | #1 Trusted Cybersecurity News Site — Index Page

Snowden files : NSA can crack almost any Encryption including Tor anonymity network

Snowden files : NSA can crack almost any Encryption including Tor anonymity network

Sep 07, 2013
The spy agencies' activities have gone on for more than a decade. Now we have enough details about how the NSA eavesdrops on the internet, another explosive news has emerged yesterday from the Snowden files that NSA has the ability to decrypt most of anything that is on the internet. They have done this not through cracking encryption mathematically, but by secretly using influence and billions of dollars to insert backdoors designed to preserve their ability to eavesdrop.  Also the majority of devices connected to the Tor anonymity network may be using encryption keys that can be broken by the National Security Agency, according to Rob Graham, CEO of penetration testing firm Errata Security. The ability to crack high-level encryption is something that has been a pretty significant legend in the infosec community. Graham arrived at that conclusion after analyzing nearly 23,000 Tor connections through an exit node that Graham controls and about 76 percent of the
Major VBulletin based websites are vulnerable to Hackers; Pakistani forums defaced by Indian Hackers
Making Sense of Operational Technology Attacks: The Past, Present, and Future

Making Sense of Operational Technology Attacks: The Past, Present, and Future

Mar 21, 2024Operational Technology / SCADA Security
When you read reports about cyber-attacks affecting operational technology (OT), it's easy to get caught up in the hype and assume every single one is sophisticated. But are OT environments all over the world really besieged by a constant barrage of complex cyber-attacks? Answering that would require breaking down the different types of OT cyber-attacks and then looking back on all the historical attacks to see how those types compare.  The Types of OT Cyber-Attacks Over the past few decades, there has been a growing awareness of the need for improved cybersecurity practices in IT's lesser-known counterpart, OT. In fact, the lines of what constitutes a cyber-attack on OT have never been well defined, and if anything, they have further blurred over time. Therefore, we'd like to begin this post with a discussion around the ways in which cyber-attacks can either target or just simply impact OT, and why it might be important for us to make the distinction going forward. Figure 1 The Pu
FBI Cyber Division put 'Syrian Electronic Army' Hackers in wanted list

FBI Cyber Division put 'Syrian Electronic Army' Hackers in wanted list

Sep 05, 2013
The Syrian Electronic Army (SEA) , a pro-regime hacker group that emerged during Syrian anti-government protests in 2011, and involved in cyber attacks against western media organizations are now in the FBI's wanted list. The Federal Bureau of Investigation has issued an alert warning of cyber attacks by the Syrian Electronic Army and finally put them on its radar. " The SEA'S primary capabilities include spear-phishing, web defacements, and hijacking social media accounts to spread propaganda. " they said. The FBI also has increased its surveillance of Syrians living in the US. According to some anti-Assad activists, the group was founded by former intelligence agents and hardcore Assad supporters. SEA had compromised social media profiles for Western news organizations by sending fake email messages to news staff in an attempt to gain access to login credentials. Most recently, the group grabbed international attention after commandeering the webs
cyber security

Automated remediation solutions are crucial for security

websiteWing SecurityShadow IT / SaaS Security
Especially when it comes to securing employees' SaaS usage, don't settle for a longer to-do list. Auto-remediation is key to achieving SaaS security.
Hesperbot - A New Banking Trojan that can create hidden VNC server on infected systems

Hesperbot - A New Banking Trojan that can create hidden VNC server on infected systems

Sep 05, 2013
Security firm ESET has discovered  a new and effective banking trojan , targeting online banking users and designed to beat the mobile multi-factor authentication systems. Hesperbot detected as Win32/Spy.Hesperbot is very identical to the infamous Zeus and SpyEye Banking Malwares and infects users in Turkey, the Czech Republic, Portugal, and the United Kingdom. Trojan has functionalities such as keystroke logging , creation of screenshots and video capture, and setting up a remote proxy. The attackers aim to obtain login credentials giving them access to the victim's bank account and getting them to install a mobile component of the malware on their Symbian, Blackberry or Android phone. Some other advanced tricks are also included in this banking Trojan, such as creating a hidden VNC server on the infected system and can do network traffic interception with HTML injection capabilities. So far, the Trojan hasn't spread too far. The campaign was first detec
Warning : Fake Grand Theft Auto V torrent spreading malware

Warning : Fake Grand Theft Auto V torrent spreading malware

Sep 05, 2013
Excitement continues .. Rockstar Games schedule the release of latest The Grand Theft Auto series, GTA 5  on September 17, but Cyber Criminals has already released a fake version of GTA 5 contains malware on torrent networks. Romanian security firm BitDefender issued warning that GTA V hasn't been leaked, and during installation you will be asked to complete a survey and send off a text message to gain the serial number. You will then be charged €1 per day on your phone bill and will be infected by a virus. The PC version has yet to be announced, so trying to install it on your PC is a ridiculous idea; but that seems to be what a lot of people are doing. " The survey opens in a web browser and, therefore, is able to perform a geographic redirect to the web page that corresponds to the area you are located in, " said, Bitdefender Senior E-Threat Analyst Bogdan Botezatu. This malware is a generic Trojan Trojan.GenericKDV.1134859 , which can steal user
Code Repository 'Github' offers Two-Factor Authentication to 3.5 million users

Code Repository 'Github' offers Two-Factor Authentication to 3.5 million users

Sep 05, 2013
Code repository GitHub  offers two-factor authentication to beef up security around its users' accounts. Github is a coding repository where developers used to build their projects projects that may turn out to be valued knowledgeable assets. Two-Factor Authentication adds another layer of authentication to the login process, Now users have to enter their username and password, and a secret code in the second step, to complete the sign in. If a hacker manages to steal a user's credentials through phishing or trojans, cannot do anything, as they do need a second key to enter. " We strongly urge you to turn on 2FA for the safety of your account, not only on GitHub, but on other websites that support it, " the company says . This two-factor authentication for Githu can be turned on in your account settings. GitHub hit 3.5 million users' landmark along with 6 million repositories deposited on its 5th anniversary in April. Two-factor authentication can protect you
Hacking Facebook to delete any account; Facebook again refuses to pay Bounty

Hacking Facebook to delete any account; Facebook again refuses to pay Bounty

Sep 05, 2013
In the past few days, Facebook refused to pay bounty to Khalil Shreateh , the security researcher who used the bug he discovered to post directly on Facebook CEO Mark Zuckerberg 's Timeline after Facebook Security rejected his attempts to report it. Ehraz Ahmed, an independent Security Researcher claimed that he reported a critical vulnerability to the Facebook Security team, which allows the attacker to delete any account from Facebook. But Facebook refuses to Pay Bug Bounty , because he tested flaw once on his friend's account, " I reported this bug to Facebook, I'm really not happy with them. After waiting for such a long time for their reply, they denied it saying that you used this bug only works for test accounts, where as I used it for removing real accounts and now the vulnerability is also fixed after their email." he said on his blog . Video Demonstration of Exploit: Vulnerable  URL : https://www.facebook.com/ajax/whitehat/delete_
J.A.R.V.I.S : Artificial Intelligence Assistant Operating System for Hackers

J.A.R.V.I.S : Artificial Intelligence Assistant Operating System for Hackers

Sep 05, 2013
A group of Indian Hackers has designed Artificial Intelligence Assistant Operating System called ' J.A.R.V.I.S ' , who recognizes them, answer questions, tweet for them and Collect information, scan targets for them. Chiragh Dewan, a 18 year old student who is currently pursuing his BCA has taken the initiative to be the first Indian to complete this project  J.A.R.V.I.S , which is inspired by Iron Man's (movie) artificial intelligence assistant Jarvis. With his team of 7 including Himanshu Vaishnav, Mayur Singh, Krishanu Kashyap, Vikas Kumar, Vinmay Nair and Sravan Kumar, they are about to finish the 3rd level of the project. Their long term goal is to create an OS which could adapt itself according to the user's needs. Like if a doctor is using the OS, it will adapt itself so as it is capable of helping him out in his field like searching for new techniques, medicines, help in their research, etc. Add for architects, other professions.  As for users i
Secunia CSI 7.0 - Next generation Patch Management tool released

Secunia CSI 7.0 - Next generation Patch Management tool released

Sep 04, 2013
Cybercrime costs organizations millions of dollars and to protect business from the consequences of security breaches, vulnerability intelligence and patch management are basic necessities in the toolbox of any IT team, as emphasized by organizations like the SANS Institute and the National Institute of Standards and Technology under the US Department of Commerce (NIST). The Secunia CSI 7.0 is the Total Package: Vulnerability Intelligence, Vulnerability Scanning with Patch Creation and Patch Deployment Integration. To help IT teams counter the threat, vulnerability research company Secunia merges the in-house vulnerability expertise with a sophisticated patch management solution into the Secunia Corporate Software Inspector (CSI 7.0). The foundation of the Secunia CSI is a unique combination of vulnerability intelligence and vulnerability scanning, with patch creation and patch deployment integration. The Secunia CSI integrates with Microsoft WSUS and System Center 2
Vulnerability allowed hacker to Delete any Facebook Photo; Rewarded with $12,500 for reporting bug

Vulnerability allowed hacker to Delete any Facebook Photo; Rewarded with $12,500 for reporting bug

Sep 01, 2013
Indian Security Enthusiast ' Arul Kumar ' recently reported an interesting Facebook vulnerability that allowed him to delete any Facebook image within a minute. Facebook Bug Bounty program rewarded him with  $12,500 USD for helping the Facebook Security team to patch this critical loophole in their own " Support Dashboard ". The flaw is critical because using this exploitation method hacker can also delete Mark Zuckerberg's ( Facebook Founder ) Photos from his Photo Album, or even from wall of any verified page too. Arul posted on his blog, " The Support Dashboard is a portal designed to help you track the progress of the reports you make to Facebook. From your Support Dashboard, you can see if your report has been reviewed by Facebook employees who assess reports 24 hours a day, seven days a week ." That means, if you will report abuse the targeted image and send a Photo Removal Request, Facebook Server Will automatically generate
Cybersecurity Resources