The Hacker News | #1 Trusted Cybersecurity News Site — Index Page

An Independent Security Researcher from Egypt has discovered a critical vulnerability in Uber app that could allow an attacker to brute force Uber promo code value and get valid codes with the high amount of up to $25,000 for more than one free rides. Mohamed M.Fouad has discovered a " promo codes brute-force attack " vulnerability in the sign-up invitation link for Uber that allows any user to invite another user to join the service and get one or more than one free rides based on the promotion code value. Fouad realized that the Uber app did not have any kind of protection against brute-force attacks, allowing him to generate promo codes ( that start with 'uber+code_name' ) until he found valid ones. The brute force attempt helped Fouad find several numbers of valid promo codes with high value in US dollar between $5,000 to $25,000, which would have helped him get a number of free rides between one to three. Fouad has also provided a video demonstration

Apple's new iOS 10 recently made headlines after MIT Technology Review revealed that the company had left the kernel of the mobile operating system unencrypted. Yes, the first developer preview of iOS 10 released at WWDC has an unencrypted kernel. When the headline broke, some of the users were surprised enough that they assumed Apple had made a mistake by leaving unencrypted kernel in iOS 10, and therefore, would get reverted in the next beta version of the operating system. However, Apple managed to confirm everyone that the company left the iOS 10 kernel unencrypted intentionally, as the kernel cache does not contain any critical or private information of users. On iOS, the kernel is responsible for things like security and how applications are capable of accessing the parts of an iPhone or an iPad. But, Why Apple had left the iOS wide open when other features like iMessage offer end-to-end encryption ? Apple did this on purpose, because by leaving the iOS 10 kernel

It comes as no surprise that today's cyber threats are orders of magnitude more complex than those of the past. And the ever-evolving tactics that attackers use demand the adoption of better, more holistic and consolidated ways to meet this non-stop challenge. Security teams constantly look for ways to reduce risk while improving security posture, but many approaches offer piecemeal solutions – zeroing in on one particular element of the evolving threat landscape challenge – missing the forest for the trees.  In the last few years, Exposure Management has become known as a comprehensive way of reigning in the chaos, giving organizations a true fighting chance to reduce risk and improve posture. In this article I'll cover what Exposure Management is, how it stacks up against some alternative approaches and why building an Exposure Management program should be on  your 2024 to-do list. What is Exposure Management?  Exposure Management is the systematic identification, evaluation,

We have been hearing a lot about Rule 41 after the US Department of Justice has pushed an update to the rule. The change to the Rule 41 of the Federal Rules of Criminal Procedure grants the FBI much greater powers to hack legally into any computer across the country, and perhaps anywhere in the world, with just a single search warrant authorized by any US judge. However, both civil liberties groups and tech companies have blasted the proposed change, saying it is an affront to the Fourth Amendment and would allow the cops and Feds in America to hack remotely into people's computers and phones around the world. Google, Electronic Frontier Foundation (EFF), Demand Progress, FightForTheFuture, TOR (The Onion Router), Private Internet Access and other VPN providers have joined their hands to block changes to Rule 41. " The U.S. government wants to use an obscure procedure—amending a federal rule known as Rule 41— to radically expand their authority to hack," the

When it comes to data breaches of major online services like LinkedIn , MySpace , Twitter and VK.com , it's two-factor authentication that could save you from being hacked. Two-factor authentication or 2-step verification is an effective way to secure online accounts, but many users avoid enabling the feature just to save themselves from irritation of receiving and typing a six-digit code that takes their 10 to 15 extra seconds. Now, Google has made the 2-Step Verification (2FV) process much easier for its users, allowing you to login with just a single tap instead of typing codes. Previously, you have had to manually enter a six-digit code received via an SMS or from an authenticator app, but now… Google has introduced a new method called " Google Prompt " that uses a simple push notification where you just have to tap on your mobile phone to approve login requests. Also Read: Google Plans to Kill your Passwords . In other words, while signing in to your

What do you do to protect your 'Privacy' and keep yourself safe from potential hackers? Well, Facebook CEO Mark Zuckerberg just need a bit of tape to cover his laptop webcam and mic jack in order to protect his privacy. Yes, Zuck also does the same as the FBI Director James Comey . Zuckerberg posted a photo on Tuesday to celebrate Instagram's 500 Million monthly user milestone, but the picture end up revealing about another security measure he takes to ensure that nobody is spying on him – and it's surprisingly simple. Some eagle-eyed observers quickly noticed that the MacBook Pro on Zuckerberg's desk in the background of the image has the tape covering not only the webcam, but also the laptop's dual microphones. While some tried to argue that it was not Zuckerberg's desk, Gizmodo pointed out that Zuckerberg has posted videos, live streams and images from there before, so it seems like a safe assumption. So, Zuckerberg joins FBI director Jam

China beats its own record with the World's fastest supercomputer. Sunway TaihuLight , a newly built supercomputer from China, now ranks as the world's most powerful machine. During the International Supercomputer Conference in Germany on Monday, Top500 declared China's 10.65 Million-core Sunway TaihuLight as the world's fastest supercomputer. Moreover, the supercomputer is leading by a wide margin, too. With 93 petaflops of processing power, Sunway TaihuLight is nearly three times more powerful than the world's previous fastest supercomputer, Tianhe-2 , which had been the world's fastest computer for last 3 years with speeds of 33.9 petaflops per second. That's 93 quadrillion floating point operations per second (FLOP), which means the supercomputer can perform around 93,000 trillion calculations per second, at its peak. The Sunway TaihuLight supercomputer is installed at the National Supercomputing Centre in Wuxi. "Sunway TaihuLight, with

The same group of teenage hackers that hacked Facebook CEO Mark Zuckerberg's Twitter and Pinterest accounts have hacked another the Twitter account of another high-profile person. This time, it's Twitter's ex-CEO, Dick Costolo . The hacker group from Saudi Arabia, dubbed OurMine, compromised Twitter account of former Twitter CEO on Sunday and managed to post three tweets on Costolo's Twitter timeline, first spotted by a Recode reporter. However, the tweets seemed to be just simple-worded tweets with no disturbing content. It looked like the hacking group was testing its access to the account. All the three tweets in question have since been deleted, and Costolo soon regained access to his account. Moreover, Twitter also suspended the Twitter account belonging to OurMine once again, after the company already suspended its original account following the Zuckerberg hacks. After regaining access to his account, Costolo said that the group of hackers ma

T-Mobile is the latest in the list of recent high-profile data breaches, though this time the breach is not carried out by "Peace" - the Russian hacker who was behind the massive breaches in some popular social media sites including LinkedIn , MySpace , Tumblr , and VK.com . Instead, one of the T-Mobile's employees stole more than 1.5 Million customer records at the T-Mobile Czech Republic in order to sell it on for a profit, according to local media , MF DNES. Yes, the customer service staff member tried to sell the T-Mobile customer marketing database, though it is not clear that how much of names, e-mail addresses, account numbers and other personal data of over 1.5 Million customers the database contained. The T-Mobile Czech Republic has also refused to provide any "additional specific information" about what data was leaked, due to an ongoing police investigation. Although the company assured its customers that the stolen database did not contai

A critical flaw in the video conferencing software of the Quebec Liberal Party (PLQ) − a Canadian federalist provincial political party − allowed a user to spy on and hear the strategy discussions of the party at its premises and even access the live video camera feeds. But luckily, the unknown white hat hacker who discovered the flaw alerted the PLQ staff of the security issue, showing them some videos of the discussions held at the party headquarters as a proof-of-concept. What if the hacker was having a malicious intent? He could have spied on the party's video feeds covertly and could have handed over the feeds and sensitive information, along with the working intrusion bug, to the opposition party for monetary benefits. It seems like the hacker spied on video conference meetings between PLQ's Quebec and Montreal branches. According to the hacker, the PLQ's software not only contained a security vulnerability but also used the factory default password, rep

One of the founders of notorious file-sharing website The Pirate Bay has been ordered to pay a fine worth nearly US$400,000 to several major record labels after their content was shared illegally via the platform. The penalty has been imposed on The Pirate Bay co-founder Peter Sunde by a court in Helsinki, Finland. Interestingly, Sunde, who already left the notorious file sharing site in 2009, said on Twitter that he lost the court case he did not even know about. The court case was brought by the Finnish divisions of Sony Music, Universal Music, Warner Music and EMI, accusing the Pirate Bay of illegally sharing the music of 60 of their artists through its service. The artists mentioned in the brief included " Juha Tapio, Teräsniska, Chisu, Deniece Williams, Suvi Vesa-Matti Loiri, Michael Monroe, Anna Abreau, Antti Tuisku, and Children of Bodom, " according to the local outlet Digitoday . However, the recording division did not accuse Sunde of direct infringeme

Popular code repository site GitHub is warning that a number of users' accounts have been compromised by unknown hackers reusing email addresses and passwords obtained from other recent data breaches . Yes, GitHub has become the latest target of a password reuse attack after Facebook CEO Mark Zuckerberg and Twitter . According to a blog post published by Shawn Davenport, VP of Security at GitHub, an unknown attacker using a list of email addresses and passwords obtained from the data breach of " other online services " made a significant number of login attempts to GitHub's repository on June 14. After reviewing the logins, administrators at GitHub found that the attacker had gained access to a number of its users' accounts in order to gain illicit access to their accounts' data. Although the initial source of the leaked credentials isn't clear, the recent widespread "megabreaches" of LinkedIn , MySpace , Tumblr , and the dating site Fling,

Hacking Facebook account is one of the major queries on the Internet today. It's hard to find — how to hack Facebook account or facebook messenger, but researchers found a way that can allow someone to hack Facebook account passwords with only the target's phone number and some resources. Yes, your Facebook profile can be hacked, no matter how strong your password is or how much extra security measures you have taken. No joke! Hackers with resources to exploit SS7 network can hack your Facebook login and all they need is your phone number. The weaknesses in the part of global telecom network SS7 that not only let hackers and spy agencies listen to personal phone calls and intercept SMSes on a potentially massive scale but also let them hijack social media accounts to which you have provided your phone number. SS7 or Signalling System Number 7 is a cell phone signaling protocol that is being used by more than 800 telecommunication operators worldwide to exchange i