"People have worked out that the processing power of graphics cards, due to the architecture of the chips, is more powerful than a normal processor for doing certain tasks," said Neil Lathwood, IT director at UKFast.
Showing posts with label The CYBER NEWS. Show all posts
Showing posts with label The CYBER NEWS. Show all posts
Thursday, 6 October 2011
GPU cracks 6 character password in 4 seconds
"People have worked out that the processing power of graphics cards, due to the architecture of the chips, is more powerful than a normal processor for doing certain tasks," said Neil Lathwood, IT director at UKFast.
Saturday, 1 October 2011
Nmap 5.61 TEST2 - IPv6 OS detection Added
Change Log for Nmap 5.61TEST2
- Added IPv6 OS detection system! The new system utilizes many tests similar to IPv4, and also some IPv6-specific ones that we found to be particularly effective. And it uses a machine learning approach rather than the static classifier we use for IPv4. We hope to move some of the IPv6 innovations back to our IPv4 system if they work out well. The database is still very small, so please submit anyfingerprints that Nmap gives you to the specified URL (as long asyou are certain that you know what the target system isrunning). Usage and results output are basically the same as withIPv4, but we will soon document the internal mechanisms athttp://nmap.org/book/osdetect.html, just as we have for IPv4. For anexample, try "nmap -6 -O scanme.nmap.org". [David, Luis]
- [NSE] Added 3 scripts, bringing the total to 246! You can learnmore about them at http://nmap.org/nsedoc/. Here they are (authorslisted in brackets):
- + lltd-discovery uses the Microsoft LLTD protocol to discover hostson a local network. [Gorjan Petrovski]
- + ssl-google-cert-catalog queries Google's Certificate Catalog forthe SSL certificates retrieved from target hosts. [Vasiliy Kulikov]
- + quake3-info extracts information from a Quake3-like gameserver. [Toni Ruottu]
- Improved AIX support for raw scans. This includes some patchesoriginally written by Peter O'Gorman and Florian Schmid. It alsoinvolved various build fixes found necessary on AIX 6.1 and 7.1. Seehttp://nmap.org/book/inst-other-platforms.html. [David]
- [NSE] Moved our brute force authentication cracking scripts(*-brute) from the "auth" category into a new "brute"category. Nmap's brute force capabilities have grown tremendously!You can see all 32 of them athttp://nmap.org/nsedoc/categories/brute.html. It isn't clearwhether dns-brute should be in the brute category, so for now itisn't. [Fyodor]
- Made the interface gathering loop work on Linux when an interfaceindex is more than two digits in /proc/sys/if_inet6. Joe McEacherntracked down the problem and provided the fix.
- [NSE] Fixed a bug in dns.lua: ensure that dns.query() always return two values(status, response) and replaced the workaround in asn-query.nse by the properuse. [Henri]
- [NSE] Made irc-info.nse handle the case where the MOTD is missing.Patch by Sebastian Dragomir.
Samsung Galaxy S II (AT&T) trusted pattern lock Security Bypassed
All you have to do : Wake the device using the lock key, then let the screen time out, then wake it again with the lock key and you can access all the data.
AT&T's Version of Samsung Galaxy S II is confirmed to have this security flaw, but the Sprint version or other does not suffer from this.Even I just check my own Samsung Galaxy S II (Indian Version), Yeah - ITS SAFE :)
VIDEO DEMO:
Tuesday, 27 September 2011
Download Windows 8 Developer Preview
Microsoft has released its Windows 8 Developer Preview operating system, for PCs and tablets, to the public as a free download.
Microsoft has made available three different versions of Windows 8 for download (two versions built for 64-bit systems which use new processors and can make use of more RAM, versus older 32-bit PCs that use earlier chips and less memory), which all show up as an ISO file when downloaded.
Microsoft has made available three different versions of Windows 8 for download (two versions built for 64-bit systems which use new processors and can make use of more RAM, versus older 32-bit PCs that use earlier chips and less memory), which all show up as an ISO file when downloaded.
Official Microsoft Download Links:-
Windows Developer Preview with Developer tools English, 64-bit (x64)
Windows Developer Preview without Developer tools English, 64-bit (x64)
Windows Developer Preview English, 32-bit (x86)
Sunday, 25 September 2011
HTTPS SSL encryption Vulnerable To Crypto Attack
Researchers have discovered a serious weakness in virtually all websites protected by the secure sockets layer protocol that allows attackers to silently decrypt data that's passing between a webserver and an end-user browser.
Juliano Rizzo and Thai Duong say the vulnerability compromises TLS (Transport Layer Security) 1.0, the encryption mechanism that secures Web sites accessed using HTTPS (Secure Hypertext Transfer Protocol). TLS is the successor to SSL (Secure Sockets Layer) and is widely used at financial sites. Companies, including Google, Facebook, and Twitter, are urging the wider use of TLS on the Web.
The exploit – demonstrated with a tool called BEAST – targets a flaw that could leave transactions open to attack and is being taken seriously by online payments firms.“We have got a team of security people and it is always working on updates and upgrades and they are looking into this already,” a PayPal spokesperson told PC Pro. “The details are still to be revealed, but the security people are trying to get a headstart on making sure this is kept secure."
BEAST requires attackers to gain a man-in-the-middle position. Most of the time this means that they need to be on the same network as their targets so they can intercept browser requests.BEAST has two components. One contains code that must be loaded into the victim's web browser and the second one captures and decrypts HTTPS session cookies. The researchers claim that they can decrypt any secure session cookie in five minutes on average.
Friday, 23 September 2011
50000 WordPress Sites infected with spam
Infected sites have following message at Footer :
Warning: file_get_contents(http://wplinksforwork.com/56132.. 47509328/p.php?host=… failed to open stream: php_network_getaddresses: getaddrinfo failed: Name or service not known in ..
BruCON Agnitio workshop Slides and Video Demonstration - Download
Workshop by David Rook (Security Ninja) at BruCON 2011 in Belgium. You can Download Slide from here.- A 32bit Windows Operating System (XP or 7 preferably – VM will be fine)
- .NET framework 3.5 installed
- Agnitio v2.0 installed
- Download the Pandemobium Android and iOS source code
- Download the selected vulnerable open source application
In addition to the list above the following things are optional depending on how hands on you want to be:
- Internet connection to download an application from the Android market place
- Eclipse IDE installed
- Android SDK installed
- Android Debug Bridge (adb) installed, this should be installed as part of the SDK install
- An AVD configured with the Android market place app installed (instructions here)
- I think you can also use a rooted Android device if you don’t want to use the emulator
- A quick look at static analysis and the strengths and weaknesses of humans and software
- What is Agnitio and why do I think checklists are a vital component of security code reviews
- Some examples of what can go wrong if you don’t use checklists to find and remove simple flaws
- Demos/hands on: using checklists in Agnitio to review source code, produce reports and metrics
- Demos/hands on: how to customise your Agnitio installation
- A look at mobile (Android and iOS) application security and how analysis is currently done
- Demo/hands on: using the mobile specific rule sets in the Agnitio static analysis module
- Demo/hands on: downloading an app from the marketplace and decompiling it using Agnitio
Wednesday, 21 September 2011
iPhone Skype XSS Vulnerability Lets Hackers Steal Phonebook [Video]
The problem is made more exploitable by the way Skype uses the embeddable WebKit browser; Skype developers have set the URI scheme for the embedded browser to "file://". This error allows an attacker to access the file system and read any file that the app would be allowed to read by the iOS application sandbox. One file that every iOS application has access to is the user's SQLlite AddressBook database. In a demonstration of the bugs, Phil Purviance, AppSec Consulting security researcher, showed how it was possible to extract the iPhone address book using the vulnerabilities.
Skype is aware of the issue and is working on a fix. “We are working hard to fix this reported issue in our next planned release, which we hope to roll out imminently,” Skype said in a statement.
Simple solution: Don't open text messages in the chat window, and check for a really quick update.
Tuesday, 20 September 2011
Automated Skype calls spreading fake anti-virus warning
"Attention: this is an automated computer system alert. Your computer protection service is not active. To activate computer protection, and repair your computer, go to [LINK]," says the robotic voice during a prerecorded message.
The offered link takes the most gullible and curious ones to a page that shows the typical "Computer protection inactive. Scanning… Viruses found!" message that is meant to convince them to fork over a decent amount of money - in this case, $19.95 - in order to get the offered protection.Not content with the money, they also ask for their personal information. If you weren't aware of fake anti-virus (also known as scareware) scams like this you might well be worried enough to visit the website referred to in the message, where it will pretend to scan your computer's security.
Thursday, 15 September 2011
Windows 8 Screenshot Tour: Everything You Possibly Want to Know
Yesterday Microsoft released the first preview release of Windows 8, and we spent all night testing it out and diving into how it all works. Here’s our review, and the normal Convex Coders style screenshot tour, with loads and loads of pictures.
Note: this article was so incredibly long that we broke it up into multiple pages, which isn’t something we do often.
So What’s New in Windows 8?
There’s a ton of new stuff in Windows 8, but the biggest change that you’ll notice right away is the addition of the new tile-based Metro interface, which you can see in the screenshot above. Keep in mind that this is the developer preview release, which means it’s nowhere near finished, and you should definitely not install this on your primary PC.We’ll go into loads of detail about everything as you read further, but first here’s a quick list of just some of the new features:
- Metro Interface – the new default interface in Windows 8, keep reading for everything about this.
- Faster Boot Times – Windows 8 will boot much faster than Windows 7, thanks to a partial hibernation mode and a lot of improvements in the loading process. On my old Dell laptop, it boots in less than 10 seconds – on new machines, it’s crazy fast.
- Less Memory Usage than Windows 7. That’s right. Microsoft is saying that not only will this version use less RAM than Win7, it also uses less running processes.
- Windows Explorer overhauled, now has the Ribbon UI, Revamped File Copying, and ISO mounting.
- In-Place PC Refresh will reload Windows in just a couple of clicks, keeping your files intact.
- ARM processors are now supported, which will lead to an entirely new class of low-power, battery-efficient tablets.
- Hyper-V is now part of Windows – so now you can create virtual machines easily without installing anything extra.
- Taskbar can now span multiple monitors – this very simple feature has finally made it into Windows.
- Wallpaper can now span multiple monitors – yet another feature that should have been around 10 years ago.
- Universal Spell Check across Metro applications.
- Windows Live Integration for Sync, Mail, Skydrive lets you sync all your settings across your PCs, including your files, mail, and photos. The sync is available in the preview, but the Skydrive and Mail are not yet.
- Windows Store will let you purchase Windows apps all in a single place.
- New Task Manager is completely revamped with much better tools, including a way to disable startup applications, track application resource usage over time, and even easily restart Windows Explorer.
How Can I Get Windows 8?
First, you’ll want to make sure that your PC can run Windows 8, and thankfully the Windows 8 system requirements are basically the same as Windows 7. You can probably get away with installing this on a PC with lousy specs, but obviously you’ll have a better experience on a faster machine. Here’s the specs:- 1 gigahertz (GHz) or faster 32-bit (x86) or 64-bit (x64) processor
- 1 gigabyte (GB) RAM (32-bit) or 2 GB RAM (64-bit)
- 16 GB available hard disk space (32-bit) or 20 GB (64-bit)
- DirectX 9 graphics device with WDDM 1.0 or higher driver
- Taking advantage of touch input requires a screen that supports multi-touch
Just head to dev.windows.com and download the ISO images from the page. Then head to the Microsoft Store page and download the USB/DVD Download Tool, which can put the ISO image onto a bootable flash drive for installation—all you have to do is choose the ISO, choose the drive, and wait for it to finish copying.
The setup process is nearly identical to Windows 7, so we’re not going to go into detail about it here. We’ll assume if you’re installing Windows 8 that you’re not a newb, and as such you shouldn’t need any help clicking through a couple of installer screens.
Various Install Notes:
- We were not able to get it working in VMware Workstation or Virtual PC.
- If you do want to virtualize, try VirtualBox. Many readers reported luck with this.
- You don’t need a product key or a login to download or install Windows 8.
- The preview release is supposed to auto-update. There’s no word on when the Beta release will be out, or whether it will automatically upgrade.
- The preview release does not have Media Center included. Microsoft says that it will be a part of Windows 8 though.
- If you want to disable Metro UI entirely, you can open up the registry editor and change the value of RPEnabled to 0 instead of 1 at the following key: (via NeoWin)
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\
Note that we’re not recommending this, because it makes installing Windows 8 fairly pointless. - If you’re using Internet Explorer from the Metro pane, you’ll notice that Flash doesn’t work. This is actually by design – no plugins in the Metro IE.
What’s This Metro Interface All About?
Metro is a tile-based interface focused on being clean and simple, with simple icons and beautiful typography instead of the typical shadows and raised button interfaces that we’re used to. Many tiles are more than just an application launcher, they contain live data that updates automatically—a weather tile will automatically show the latest weather report, a news title will scroll the latest from your feeds, the social widget will show the latest photos from Facebook, and your stock ticker will automatically show you what those greedy Wall Street people are up to.This interface was first released on Windows Phone, and while it’s definitely ideal for a touchscreen environment, it’s also quite usable with the keyboard and mouse—though you will find that scrolling multiple pages is much more tedious using just the mouse than using a simple swipe on the screen.
Metro Features
- Universal Sharing across applications allows applications to easily share files or text with cloud services (and each other). You can load a picture from Facebook into a photo editing app, then share it on Twitter once you’re done. And it’s all hooked into the common file open dialogs, and the new Share feature.
- Universal Search allows applications to register with the global search in the Metro interface, so you can search across any application that supports it.
- Hardware Acceleration – all Metro applications are automatically hardware accelerated, making the entire experience much more smooth.
- Process Suspending – Windows can automatically suspend Metro applications for better battery life when they aren’t being used.
- New WindowsRT runtime provides these features to any application in almost any language, with almost no extra code. That means existing applications can be easily modified to connect to social networks without writing any networking code.
The main Start screen is also a complete replacement for the Windows 7 Taskbar—you can just start typing at any point while viewing the main Metro Start screen and you’ll be able to quickly find any application on your system the same way that you could on Windows 7.
Metro Keyboard Shortcuts
These are a few keyboard shortcuts that I’ve personally been using. There’s others, but I haven’t figured out whether they work for mouse/keyboard mode or only if you’re using a touch screen with a keyboard also connected, so I won’t include them.
- Windows+F – Opens File Search
- Windows+C – Opens Charms Bar
- Windows+I – Opens Settings
- Windows+Q – Opens App Search pane
- Windows+W – Opens Settings Search app
- Windows+Z – Opens App Bar
Back on the main Metro screen, you can easily click and drag to move items around on the screen. If you’re using a touch interface, you can do the same thing with your fingers. You can even zoom out using a Pinch gesture to see all of the items on the screen without having to scroll—as far as we can tell, there’s no way to do that in the mouse-only interface, but if you know how to do that, please leave a comment and tell us how.
Which will enable a menu at the bottom of the screen. Depending on what tile you’ve selected, you’ll either get items to make it Larger, Smaller, Uninstall it, Pin it, or Unpin it.
Some of the tiles will open up a Metro-style application, which is always full screen. The Weather application can be customized for your location, and you can even pin multiple weather tiles to the home screen for multiple locations.
You might notice the purple bar on the left hand side of the screen—that’s very important. Whenever you’re in a Metro application using a touch interface, you can swipe from the left side to flip between applications. Keep swiping left to cycle through all of the applications. This is roughly the same as using Win+Tab, which works differently in Windows 8 than it did in Windows 7. You can, of course, still use Alt+Tab the way you always did.
Backtrack 5 Wireless Penetration Testing by Vivek Ramachandran
This book will provide a highly technical and in-depth treatment of Wi-Fi security. The emphasis will be to provide the readers with a deep understanding of the principles behind various attacks and not just a quick how-to guide on publicly available tools. We will start our journey with the very basics by dissecting WLAN packet headers with Wireshark, then graduate to the next level by cracking WEP, WPA/WPA2 and then move on to real life challenges like orchestrating Man-in-the-Middle attacks, creating Wi-Fi Honeypots and compromise networks running WPA-Enterprise mechanisms such as PEAP and EAP-TTLS.
Even though touted as a Beginner's Guide, this book has something for everyone - from the kiddies to the Ninjas. You can purchase the book from:
Global: http://www.amazon.com/BackTrack-Wireless-Penetration-Testing-Beginners/dp/1849515581/
India: http://www.packtpub.com/backtrack-5-wireless-penetration-testing-beginners-guide/book
Sample Chapter can be downloaded here:
http://www.packtpub.com/sites/default/files/5580OS-Chapter-6-Attacking-the-Client_0.pdf
Author Bio:
Vivek Ramachandran, the author of the book has been into Wireless security research since 2003. He has spoken at conferences such as Blackhat, Defcon and Toorcon on Wireless Security and is the discoverer of the Caffe Latte attack. He also broke WEP Cloaking, a WEP protection schema in 2007 publically at Defcon. He was one of the programmers of the 802.1x protocol and Port Security in Cisco's 6500 Catalyst series of switches. He was one of the winners of Microsoft Security Shootout contest held in India among a reported 65,000 participants. He is best known in the hacker community as the founder of SecurityTube.net where he routinely posts videos on Wi-Fi Security, Assembly Language, Exploitation Techniques etc. Vivek's work on wireless security has been quoted in BBC online, InfoWorld, MacWorld, The Register, IT World Canada etc. places. This year he is either speaking or training at Blackhat, Defcon, Hacktivity, HITB-ML, Brucon, Derbycon, HashDays, SecurityByte etc.
For those who cannot afford to purchase the book, Vivek's Wireless Megaprimer Video series (12+ hours of HD videos on Wi-Fi Hacking) is the next best thing to it.
You can download the DVD here: http://www.securitytube.net/downloads
uTorrent & BitTorrent Sites Hacked, Spread Security Shield Malware
Once installed, Security Shield delivers false reports that a computer is infected with multiple pieces of malware and prompts the user for payment before claiming to disinfect the machine. The attack affected only users who downloaded and installed software from bittorrent.com and utorrent.com during the hour-and-fifty-minute window that the sites were compromised. Those who installed software previously are unaffected.
"We have completed preliminary testing of the malware. Upon installation, a program called ‘Security Shield" launches and pops up warnings that a virus has been detected. It then prompts a user for payment to remove the virus. " experts write on the blog.
It is very important to once more note that infected are only users who have downloaded the software between 4:20 a.m. and 6:10 a.m. Pacific time. If you have previously downloaded it - you can rest assured your software is clean.
THC-HYDRA v7.0 new version released for Download
THC-HYDRA is a very fast network logon cracker which support many different services. This tool is a proof of concept code, to give researchers and security consultants the possibility to show how easy it would be to gain unauthorized access from remote to a system. It was tested to compile cleanly on Linux, Windows/Cygwin, Solaris, FreeBSD and OSX.Official change log:
- New main engine for hydra: better performance, flexibility and stability
- New option -u – loop around users, not passwords
- Option -e now also works with -x and -C
- Added RDP module, domain can be passed as argument
- Added other_domain option to smb module to test trusted domains
- Small enhancement for http and http-proxy module for standard ignoring servers
- Lots of bugfixes, especially with many tasks, multiple targets and restore file
- Fixes for a few http-form issues
- Fix smb module NTLM hash use
- Fixed Firebird module deprecated API call
- Fixed for dpl4hydra to work on old sed implementations (OS/X …)
- Fixed makefile to install dpl4hydra (thx @sitecrea)
- Fixed local buffer overflow in debug output function (required -d to be used)
- Fixed xhydra running warnings and correct quit action event
Download THC-HYDRA v7.0
Saturday, 10 September 2011
Anonymous Releases Twitter Hijack Tool Called URGE
The long promised tool that can be used to hijack tweets was recently released on the Anonymous hacker group's official blog, complete with download links, source files and how-to instructions.
The Anonymous group of online activists released a new tool yesterday designed to allow people to hijack trending topics on Twitter and tweet messages within them.
Dubbed URGE (for Universal Rapid Gamma Emitter), the beta software is available for download for Windows computers and requires .Net Framework 4 to work.
"This is not a hacking tool nor is it an exploit tool," the group said in a statement. "It was created to make it easier for us to tweet faster without copying and pasting constantly."
Anonymous members say they are annoyed with all the redundant and "pop culture" topics featured on Twitter Trends and want to draw more attention to topics that "actually serve a cause."
"We have taken note of why Twitter would not do so, they only trend topics which would 'appeal' to people and can get people to tweet more," the statement says. "This was pathetic in our eyes, and we could not stand by and take it anymore."
URGE will allow people to spread the message of Anonymous--including "bashing corrupt politicians," among other causes--by riding the coattails of trending topics. "This will help raise awareness of problems going on in this world and show people that real problems exist outside of 'Jersey Shore' and 'Sex,'" according to the statement.
Wireshark 1.4.9 & Wireshark 1.6.2 updated version released
The following bugs have been fixed:
- configure ignores (partially) LDFLAGS. (Bug 5607)
- Build fails when it tries to #include , not present in Solaris 9. (Bug 5608)
- Unable to configure zero length SNMP Engine ID. (Bug 5731)
- BACnet who-is request device range values are not decoded correctly in the packet details window. (Bug 5769)
- H.323 RAS packets missing from packet counts in “Telephony->VoIP Calls” and the “Flow Graph” for the call. (Bug 5848)
- Wireshark crashes if sercosiii module isn’t installed. (Bug 6006)
- Editcap could create invalid pcap files when converting from JPEG. (Bug 6010)
- Timestamp is incorrectly decoded for ICMP Timestamp Response packets from MS Windows. (Bug 6114)
- Malformed Packet in decode for BGP-AD update. (Bug 6122)
- Wrong display of CSN_BIT in CSN.1. (Bug 6151)
- Fix CSN_RECURSIVE_TARRAY last bit error in packet-csn1.c. (Bug 6166)
- Wireshark cannot display Reachable time & Retrans timer in IPv6 RA messages. (Bug 6168)
- ReadPropertyMultiple-ACK not correctly dissected. (Bug 6178)
- GTPv2 dissectors should treat gtpv2_ccrsi as optional. (Bug 6183)
- BGP : AS_PATH attribute was decode wrong. (Bug 6188)
- Fixes for SCPS TCP option. (Bug 6194)
- Offset calculated incorrectly for sFlow extended data. (Bug 6219)
- [Enter] key behavior varies when manually typing display filters. (Bug 6228)
- Contents of pcapng EnhancedPacketBlocks with comments aren’t displayed. (Bug 6229)
- Misdecoding 3G Neighbour Cell Information Element in SI2quater message due to a coding typo. (Bug 6237)
- Mis-spelled word “unknown” in assorted files. (Bug 6244)
- tshark run with -Tpdml makes a seg fault. (Bug 6245)
- btl2cap extended window shows wrong bit. (Bug 6257)
- NDMP dissector incorrectly represents “ndmp.bytes_left_to_read” as signed. (Bug 6262)
- TShark/dumpcap skips capture duration flag occasionally. (Bug 6280)
- File types with no snaplen written out with a zero snaplen in pcap-ng files. (Bug 6289)
- Wireshark improperly parsing 802.11 Beacon Country Information tag. (Bug 6264)
- ERF records with extension headers not written out correctly to pcap or pcap-ng files. (Bug 6265)
- RTPS2: MAX_BITMAP_SIZE is defined incorrectly. (Bug 6276)
- Copying from RTP stream analysis copies 1st line many times. (Bug 6279)
- Wrong display of CSN_BIT under CSN_UNION. (Bug 6287)
- MEGACO context tracking fix – context id reuse. (Bug 6311)
Updated Protocol Support BACapp, Bluetooth L2CAP, CSN.1, DCERPC, GSM A RR, GTPv2, ICMP, ICMPv6, IKE, MEGACO, MSISDN, NDMP, OpenSafety, RTPS2, sFlow, SNMP, TCP
New and Updated Capture File Support
CommView, pcap-ng, JPEG.
Download Wireshark
Norton Cybercrime Report 2011
For the first time a Norton study calculates the cost of global cybercrime: $114 billion annually.Based on the value victims surveyed placed on time lost due to their cybercrime experiences, an additional $274 billion was lost. With 431 million adult victims globally in the past year and at an annual price of $388 billion globally based on financial losses and time lost, cybercrime costs the world significantly more than the global black market in marijuana, cocaine and heroin combined ($288 billion).
Read more on Norton
Tuesday, 30 August 2011
19 years old iPhone hacker Nicholas Allegra (comex) joins Apple
Allegra tweeted the news on Thursday, saying that he’d been pretty bored lately and that he’ll start at Apple in two weeks.
Jailbreakers say that they want to have more control over their phones, and programs like those Comex produces help iPhone users circumvent some of the strictures of Apple’s iOS system. The programs also can cause security issues if programmers with more sinister intentions use them.
From that angle, it’s a great idea for Apple to take Comex on board. He definitely knows the holes in Apple’s systems and, in theory, how to protect them as well. When security industry superstars recognize your work as being the best, then it's clear that you're a talented individual.
Hacking a Facebook Account using Facebook
Many of us know that phishing is also a trick to hack a facebook and session hijicking but hacker can do both at a same time. This vulnerability was happened on Facebook (static FBML) .Example here
What user will do ??
1. Checks for the URL.
2. Checks for which year the page was create.
Is it easy to fool the people?
Yes, by creating a new page in facebook in such way that user has to beliveness.
How its work??
1.Once the user clicks the link the session(cookies) where stolen by the hacker using That he can login any users account without a username and password
2. usually the users will check for the URL once it was known 1 they can enterning a userename and password.
3.After hitting the button Test your Password , Page will reflect a Thankyou Msg and it will popup with a paswd Rank
4. Check ur email spam there must a email on this and it will say that ur password was wrong trying again
Countermeasures:
1.Dont click a new link from a person u don’t know..
2.Facebook is not going to ask ur password is strong are not.
3.Some of the virus and worm (scam) was spreading in facebook applications.
Submitter By Noah Franklin
"Hackers can die but Hacking never dies"
Saturday, 27 August 2011
Apple Website Hacked by HodLuM
One of the Apple Sub-Domain claimed to be Defaced By HodLuM as shown above. The Deface Link is just an IMAGE uploaded to Apple domain. Hacker use "N00BZ" word for all Hacker including Anonymous , Lulzsec, Turkish hackers, Inj3t0rs and Exploit-DB's. AOL Postmaster Website was also got hacked by HODLUM some months before.
Sunday, 21 August 2011
Idea Cellular Web Portal Hacked, Customers Info may be exposed !
Target Website: http://www.ideacellular.com
Attack Type: Hidden SQL Injection Vulnerability
Database Type: MySql 5.0.27
Alert Level: Critical
Alert Level: Critical
Threats: Database Access, Database Dump
Credit: zSecure Team
Previous Vulnerability Discolsures: Dukascopy, Sify, TimesofMoney, Sharekhan
Credit: zSecure Team
Previous Vulnerability Discolsures: Dukascopy, Sify, TimesofMoney, Sharekhan
Proof of Vulnerability:
About the Company
Idea is the 3rd largest mobile services operator in India. Idea’s strong growth in the Indian telephony market comes from its deep penetration in the non-urban and rural markets. IDEA Cellular is an Aditya Birla Group Company, India’s first truly multinational corporation. The group operates in 26 countries, and is anchored by over 130,600 employees belonging to 40 nationalities. The Group has been adjudged the ‘6th Top Company for Leaders in Asia Pacific Region’ in 2009, in a survey conducted by Hewitt Associates, in partnership with The RBL Group, and Fortune. The Group has also been rated ‘The Best Employer in India and among the Top 20 in Asia’ by the Hewitt-Economic Times and Wall Street Journal Study 2007.
Disclaimer
SourceNo data has been dumped; zSecure Team randomly tried the security of ideacellular web portal and in our very first attempt they discovered this critical flaw. Since this flaw was discovered in their very first attempt, existence of other flaws can’t be denied.
Database has been accessed just to take screenshots so that they can make company believe that the aforesaid flaw actually because most of the companies use to treat the like advisories/disclosure as junk and don’t believe the researcher’s which may later cause them huge.
As well said zSecure Team respect the confidentiality of Ideacelluar that’s why they restricted the contents of their screen-shots to database tables only. W e hope that company Ideacellular will take some immediate steps to fix-up this critical vulnerability asap.
