#1 Trusted Cybersecurity News Platform Followed by 4.50+ million
The Hacker News Logo
Get the Free Newsletter
SaaS Security

The Hacker News | #1 Trusted Cybersecurity News Site — Index Page

Searching for Leaked Celebrity Photos? Don't Blindly Click that Fappening Link!

Searching for Leaked Celebrity Photos? Don't Blindly Click that Fappening Link!

Mar 21, 2017
Are you curiously googling or searching torrents for photos or videos of Emma Watson, Amanda Seyfried, Rose McGowan, or any other celebrities leaked in The Fappenning 2.0 ? If yes, then beware, you should not click any link promising Fappenning celebrity photos . Cybercriminals often take advantage of news headlines in order to trap victims and trick them into following links that may lead to websites containing malware or survey scams. Last week, a few private photos of Emma Watson and Amanda Seyfried — ranging from regular selfies to explicitly sexual photos — were circulating on the Internet forums, including Reddit and 4chan, with UK's TV presenter Holly Willoughby and US actor Rose McGowan among the latest alleged victims. Now, according to the security researchers from MalwareBytes, scammers are exploiting this new batch of leaked celebrity photos and videos by using their stolen selfies to lure victims on social media sites and making dollars. Also Read: Hacke
Hacker Reveals Easiest Way to Hijack Privileged Windows User Session Without Password

Hacker Reveals Easiest Way to Hijack Privileged Windows User Session Without Password

Mar 20, 2017
You may be aware of the fact that a local Windows user with system rights and permissions can reset the password for other users, but did you know that a local user can also hijack other users' session, including domain admin/system user, without knowing their passwords? Alexander Korznikov, an Israeli security researcher, has recently demonstrated that a local privileged user can even hijack the session of any logged-in Windows user who has higher privileges without knowing that user's password, using built-in command line tools. This trick works on almost all versions of Windows operating system and does not require any special privileges. Korznikov is himself unable to figure out if it is a Windows feature or a security flaw. The issue discovered by Korznikov is not entirely new, as a French security researcher, namely Benjamin Delpy, detailed a similar user session hijacking technique on his blog some six years ago. Korznikov calls the attack a "privilege
Making Sense of Operational Technology Attacks: The Past, Present, and Future

Making Sense of Operational Technology Attacks: The Past, Present, and Future

Mar 21, 2024Operational Technology / SCADA Security
When you read reports about cyber-attacks affecting operational technology (OT), it's easy to get caught up in the hype and assume every single one is sophisticated. But are OT environments all over the world really besieged by a constant barrage of complex cyber-attacks? Answering that would require breaking down the different types of OT cyber-attacks and then looking back on all the historical attacks to see how those types compare.  The Types of OT Cyber-Attacks Over the past few decades, there has been a growing awareness of the need for improved cybersecurity practices in IT's lesser-known counterpart, OT. In fact, the lines of what constitutes a cyber-attack on OT have never been well defined, and if anything, they have further blurred over time. Therefore, we'd like to begin this post with a discussion around the ways in which cyber-attacks can either target or just simply impact OT, and why it might be important for us to make the distinction going forward. Figure 1 The Pu
Microsoft Started Blocking Windows 7/8.1 Updates For PCs Running New Processors

Microsoft Started Blocking Windows 7/8.1 Updates For PCs Running New Processors

Mar 20, 2017
You might have heard the latest news about Microsoft blocking new security patches and updates for Windows 7 and Windows 8.1 users running the latest processors from Intel, AMD, Qualcomm, and others. Don't panic, this new policy doesn't mean that all Windows 7 and 8.1 users will not be able to receive latest updates in general because Microsoft has promised to support Windows 7 until 2020 , and Windows 8.1 until 2023. But those who have upgraded their machines running older versions of Windows to the latest processors, or manually downgraded their new laptops to run Windows 7/8.1 would be out of luck. A recently published Microsoft Knowledge Base article suggests that if you are running the older version of operating systems on your computers that feature new processors, including Intel's 7th generation Core i3, i5 and i7 ("Kaby Lake"), AMD Ryzen ("Bristol Ridge") and Qualcomm 8996 chips or later, the security updates will not install. Inste
cyber security

Automated remediation solutions are crucial for security

websiteWing SecurityShadow IT / SaaS Security
Especially when it comes to securing employees' SaaS usage, don't settle for a longer to-do list. Auto-remediation is key to achieving SaaS security.
Disable TELNET! Cisco finds 0-Day in CIA Dump affecting over 300 Network Switch Models

Disable TELNET! Cisco finds 0-Day in CIA Dump affecting over 300 Network Switch Models

Mar 20, 2017
Cisco is warning of a new critical zero-day IOS / IOS XE vulnerability that affects more than 300 of its switch models. The company identified this highest level of vulnerability in its product while analyzing " Vault 7 " — a roughly 8,761 documents and files leaked by Wikileaks last week, claiming to detail hacking tools and tactics of the Central Intelligence Agency (CIA). The vulnerability resides in the Cluster Management Protocol (CMP) processing code in Cisco IOS and Cisco IOS XE Software. If exploited, the flaw ( CVE-2017-3881 ) could allow an unauthenticated, remote attacker to cause a reboot of an affected device or remotely execute malicious code on the device with elevated privileges to take full control of the device, Cisco says in its  advisory . The CMP protocol has been designed to pass around information about switch clusters between cluster members using Telnet or SSH. The vulnerability is in the default configuration of affected Cisco devices,
WikiLeaks Won't Disclose CIA Exploits To Companies Until Certain Demands Are Met

WikiLeaks Won't Disclose CIA Exploits To Companies Until Certain Demands Are Met

Mar 18, 2017
It's been over a week since Wikileaks promised to hand over more information on hacking tools and tactics of the Central Intelligence Agency (CIA) to the affected tech companies, following a leak of a roughly 8,761 documents that Wikileaks claimed belonged to CIA hacking units. "We have decided to work with them, to give them some exclusive access to some of the technical details we have, so that fixes can be pushed out," WikiLeaks' founder Julian Assange said during a Facebook Live press conference last week. However, it looks like the things aren't that easier for tech companies as they look. After days of waiting, Assange made its first contact with Apple, Microsoft, and Google this week and finally made his intentions clear – no sharing of bugs and vulnerabilities the CIA is or was allegedly taking advantage of until certain demands are met. Multiple anonymous sources familiar with the matter told Motherboard that Assange sent an email to Apple,
Sony Is Working On Mobile-to-Mobile Wireless Charging Technology

Sony Is Working On Mobile-to-Mobile Wireless Charging Technology

Mar 17, 2017
So you are in a party with your friends, and your phone is running low on battery. Oops! The ideal solution is to charge your phone using a charger or a power bank, but not everyone carries power banks or chargers with them all the time, especially in a party. What if you can charge your phone wirelessly using another phone when it runs out of battery? Isn't that great? Well, thanks to Sony, you might soon be able to use your friends' phones to charge your own device. According to a recently published patent application, Sony is working on a new futuristic technique that enables wireless power exchange between various nearby consumer electronic devices, including smartphones, computers, microwave, washing machine, fridges, and TVs, without cords. Wireless charging isn't a new concept at all, but this is the first time when the Near Field Communications (NFC) technology is being used for power transfer wirelessly between two devices, that too over considerable distanc
Linux Kernel Gets Patch For Years-Old Serious Vulnerability

Linux Kernel Gets Patch For Years-Old Serious Vulnerability

Mar 16, 2017
Another dangerous vulnerability has been discovered in Linux kernel that dates back to 2009 and affects a large number of Linux distros, including Red Hat, Debian, Fedora, OpenSUSE, and Ubuntu. The latest Linux kernel flaw ( CVE-2017-2636 ), which existed in the Linux kernel for the past seven years, allows a local unprivileged user to gain root privileges on affected systems or cause a denial of service (system crash). Positive Technologies researcher Alexander Popov discovered a race condition issue in the N_HLDC Linux kernel driver – which is responsible for dealing with High-Level Data Link Control (HDLC) data – that leads to double-free vulnerability. " Double Free " is one of the most common memory corruption bug that occurs when the application releases same memory location twice by calling the free() function on the same allocated memory. An unauthenticated attacker may leverage this vulnerability to inject and execute arbitrary code in the security context of curren
Yahoo! Hack! How It Took Just One-Click to Execute Biggest Data Breach in History

Yahoo! Hack! How It Took Just One-Click to Execute Biggest Data Breach in History

Mar 16, 2017
In the digital world, it just takes one click to get the keys to the kingdom. Do you know spear-phishing was the only secret weapon behind the biggest data breach in the history? It's true, as one of the Yahoo employees fell victim to a simple phishing attack and clicked one wrong link that let the hackers gain a foothold in the company's internal networks. You may be familiar with phishing attacks — an attempt to steal user credentials or financial data — while, Spear-phishing is a targeted form of phishing in which attackers trick employees or vendors into providing remote-access credentials or opening a malicious attachment containing an exploit or payload. Here's how the Yahoo's massive data breach was traced back to human error and who were the alleged masterminds behind this hack. On Wednesday, the US government charged two Russian spies (Dmitry Dokuchaev and Igor Sushchin) and two criminal hackers (Alexsey Belan and Karim Baratov) in connection with the 20
It's Fappening Again! Private Photos of Emma Watson and Others Leaked Online

It's Fappening Again! Private Photos of Emma Watson and Others Leaked Online

Mar 16, 2017
Are you clicking selfies? That is fine and not any criminal act, but this act can land you in trouble — here's how! Almost three years after a wave of private photographs of celebrities leaked online, "The Fappening 2.0" appears to be underway with the circulation of alleged naked pictures of female celebrities, including Emma Watson and Amanda Seyfried on Reddit and 4chan. Back in 2014, anonymous hackers flooded the Internet with private photographs of major celebrities, including Jennifer Lawrence , Kim Kardashian , Kate Upton and Kirsten Dunst by hacking thousands of Apple's iCloud accounts . The Fappening hackers have since been sent to prison . The Fappening 2.0: It's Happening Again! However, in the latest leak, which has been heralded online as "The Fappening 2.0," the personal photographs of Amanda Seyfried and Emma Watson — ranging from regular selfies to explicitly sexual photos — have been leaking online since Tuesday night.
US Charges Two Russian Spies & Two Hackers For Hacking 500 Million Yahoo Accounts

US Charges Two Russian Spies & Two Hackers For Hacking 500 Million Yahoo Accounts

Mar 15, 2017
The 2014 Yahoo hack disclosed late last year that compromised over 500 million Yahoo user accounts was believed to be carried out by a state-sponsored hacking group. Now, two Russian intelligence officers and two criminal hackers have been charged by the US government in connection with the 2014 Yahoo hack that compromised about 500 million Yahoo user accounts, the Department of Justice announced Wednesday. According to the prosecutors, at least 30 million accounts were accessed as part of a spam campaign to access the email contents of thousands of people, including journalists, government officials, and technology company employees. The four defendants — Two officers from the Russian Federal Security Service (FSB) and two other hackers — are identified as: Dmitry Aleksandrovich Dokuchaev, 33 — an officer in the FSB Center for Information Security at the time of the hack, and now Russian national and resident. Igor Anatolyevich Sushchin, 43 — an FSB officer, a superior
Cybersecurity Resources