#1 Trusted Cybersecurity News Platform Followed by 4.50+ million
The Hacker News Logo
Get the Free Newsletter
SaaS Security

The Hacker News | #1 Trusted Cybersecurity News Site — Index Page

Jobvite Recruitment Service Website Vulnerable to Hackers

Jobvite Recruitment Service Website Vulnerable to Hackers

Aug 04, 2014
Jobvite , a recruiting platform for the social web, is found vulnerable to the most common, but critical web application vulnerabilities that could allow an attacker to compromise and steal the database of the company's website. Jobvite is a Social recruiting and applicant tracking created for companies with the highest expectations of recruiting technology and candidate quality. Growing companies use Jobvite's social recruiting, sourcing and talent acquisition solutions to target the right talent and build the best teams. An independent security researcher Mohamed M. Fouad from Egypt, has found two major flaws in Jobvite website  that could be used by an attacker to comprise the company's web server. As a responsible security researcher, Fouad also reported the critical flaws three months ago to the Jobvite team, but the company didn't fix it till now. According to Fouad, Jobvite is vulnerable to Boolean SQLi (SQL injection) and LFI (local file inclusion) v
POWELIKS — A Persistent Windows Malware Without Any Installer File

POWELIKS — A Persistent Windows Malware Without Any Installer File

Aug 04, 2014
Malware is nothing but a malicious files which is stored on an infected computer system in order to damage the system or steal sensitive data from it or perform other malicious activities. But security researchers have uncovered a new and sophisticated piece of malware that infects systems and steals data without installing any file onto the targeted system. Researchers dubbed this  persistent malware as Poweliks , which resides in the computer registry only and is therefore not easily detectable as other typical malware that installs files on the affected system which can be scanned by antivirus or anti-malware Software. According to Paul Rascagneres , Senior Threat Researcher, Malware analyst at GData software, due to the malware's subsequent and step-after-step execution of code, the feature set was similar to a stacking principles of Matryoshka Doll approach. Paul has made a number of name ripping malware and bots to uncover and undermine cyber crimes. He won last
How to Accelerate Vendor Risk Assessments in the Age of SaaS Sprawl

How to Accelerate Vendor Risk Assessments in the Age of SaaS Sprawl

Mar 21, 2024SaaS Security / Endpoint Security
In today's digital-first business environment dominated by SaaS applications, organizations increasingly depend on third-party vendors for essential cloud services and software solutions. As more vendors and services are added to the mix, the complexity and potential vulnerabilities within the  SaaS supply chain  snowball quickly. That's why effective vendor risk management (VRM) is a critical strategy in identifying, assessing, and mitigating risks to protect organizational assets and data integrity. Meanwhile, common approaches to vendor risk assessments are too slow and static for the modern world of SaaS. Most organizations have simply adapted their legacy evaluation techniques for on-premise software to apply to SaaS providers. This not only creates massive bottlenecks, but also causes organizations to inadvertently accept far too much risk. To effectively adapt to the realities of modern work, two major aspects need to change: the timeline of initial assessment must shorte
Thousands of Mozilla Developers Emails and Password Exposed Accidentally

Thousands of Mozilla Developers Emails and Password Exposed Accidentally

Aug 04, 2014
Mozilla on Friday notified users of its Mozilla Developer Network (MDN) that the company has accidentally exposed the e-mail addresses and cryptographically protected passwords of thousands of Mozilla developers. The email addresses of over 76,000 members of its Developer Network, along with 4000 "salted" passwords were disclosed through a database glitch that may have been exploited by hackers, Mozilla officials warned Friday. The database glitch caused due to a data " sanitization " process failure, that was lasted for a month beginning on June 23, which inadvertently published the records of members of the MDN and left on a publicly accessible server for around a month until one of the outfit's web developers discovered their presence on a server accessible to the general public around a couple of weeks back, according to a blog post . " As soon as we learned of it, the database dump file was removed from the server immediately, and the process that ge
cyber security

Automated remediation solutions are crucial for security

websiteWing SecurityShadow IT / SaaS Security
Especially when it comes to securing employees' SaaS usage, don't settle for a longer to-do list. Auto-remediation is key to achieving SaaS security.
Hurray! Unlocking Your Cell Phone is Officially Legal Again

Hurray! Unlocking Your Cell Phone is Officially Legal Again

Aug 02, 2014
President Barack Obama signed a bill into law Friday that aims to make it legal for consumers to "unlock" their cell phones in order to change their cell phone service providers without paying for a new phone. The bill is known as the Unlocking Consumer Choice and Wireless Competition Act , which orders the U.S. Library of Congress (LoC) to allow cell phone owners to " unlock " their devices – typically " locked ," to a specific service provider like AT&T or Verizon – for its use on other networks without the permission of their service provider. " As long as their phone is compatible and they have complied with their contracts, consumers will now be able to enjoy the freedom of taking their mobile service - and a phone they already own - to the carrier that best fits their needs, " the White House said in a statement . UNLOCKING Vs. JAILBREAKING Unlocking means the device can only access the network of a particular telecomm, like AT&T or Veriz
Godzilla Hacker Takes Down Several Pakistani Government Websites

Godzilla Hacker Takes Down Several Pakistani Government Websites

Aug 02, 2014
While the rest of the world was engaged in cyber security and privacy, an Indian patriotic hacker targeted 43 major Pakistani Government official websites, including 'President of Pakistan', 'Government of Pakistan', 'Ministry of Defence' , and whole Ministry of Pakistan . Indian hacker Godzilla claimed responsibility to hack into one of the main proxy server of the Pakistan Government, which is being used to manage all the government websites. Once the hacker gained the access to the proxy server, he managed to take down those websites. The attack on the websites are supposed to be severe as it has been over 24 hours and the websites are still down at the time of writing. The hacker posted a message on his Facebook profile saying, " Poor Pakistan no matter how hard you try we can bypass those security anytime we want. Before making a statement in media against India think twice. " Godzilla aka G.O.D is the same hacker who launched a cyber attack last year on a number of ser
Anonymous Group Takes Down Mossad's Website Over Gaza Conflict

Anonymous Group Takes Down Mossad's Website Over Gaza Conflict

Aug 01, 2014
The hacktivist group Anonymous has reportedly taken down the official website of the Israeli intelligence agency Mossad against Israel's military incursion in Gaza, which has resulted in hundreds of civilian casualties. The government of Israel has yet to comment on the Mossad hack attack. The ' Hacktivists ' were able to take down Mossad's website in a Distributed Denial of Service (DDoS) attack early morning, claims a statement on one of the Anonymous hacker's Twitter account. The attack on the website is supposed to be severe as it has been over 10 hours and the site is still down at the time of writing. OPERATION SAVE GAZA The Anonymous group has already targeted a number of other Israeli organizations as part of a campaign titled " Operation Save Gaza " in the mission to stop this " massacre ." Anonymous group has also claimed responsibility of taking down multiple Israeli government sites following the death of one of the organization's members. The member n
Cybersecurity Resources