Results for "cyber news"
Top 10 Infamous Student Hackers Ever
Top 10 Infamous Student Hackers Ever

1.) Sven Jaschan:

In the words of one tech expert, “His name will always be associated with some of the biggest viruses in the history of the Internet.” The viruses: the Sasser and NetSky worms that infected millions of computers and have caused millions of dollars of damage since their release in 2004. The man behind the viruses proved to be not even a man at all, legally. Seventeen-year-old hacker Sven Jaschan, a student at a computer science school in Germany, claimed to have created the viruses to become a hero by developing a program that would eradicate the rampaging Mydoom and Bagle bugs. Instead he found himself the subject of a $250,000 bounty courtesy of Microsoft, for which some of his classmates turned him in.


2.) Jonathan James:

In 2000, at the age of 16, James, or “C0mrade” as he was known in the hacker community, infamously became the first juvenile federally sentenced for hacking. The targets of his notorious hack jobs were a wing of the U.S. Department of Defense called the Defense Threat Reduction Agency, NASA, and the Marshall Space Flight Center in Huntsville, Ala. (By hacking the latter James gained the ability to control the A/C in the International Space Station.) All of these were pulled off “for fun” while James was still a student at Palmetto Senior High in Miami. Unfortunately, the fun ran out when James was tied into a massive identity theft investigation. Though insisting he was innocent, James took his own life, saying he had “no faith in the justice system.”


3.) Michael Calce:

Yahoo. CNN. Ebay. Amazon. Dell.com. One by one in a matter of days, these huge websites crashed at the hands of 15-year-old Canadian high school student Michael Calce, aka “MafiaBoy.” Armed with a denial-of-service program he called “Rivolta” that overloaded servers he targeted, the young hacker wreaked $7.5 million in damages, according to court filings. Calce was caught when he fell victim to a common ailment of teenage boys: bragging. The cops were turned on to him when he began boasting in chat rooms about being responsible for the attacks. On Sept. 12, 2001, MafiaBoy was sentenced to a group facility for eight months on 56 counts of cybercrime.


4.) Kevin Mitnick:

Before performing hacks that prompted the U.S. Department of Justice to declare him “the most wanted computer criminal in United States history,” Kevin Mitnick had already made a name for himself as a hacker in his school days, first at Monroe High School in LA and later at USC. On a dare, Mitnick connived an opening into the computer system of Digital Equipment Corporation, which some fellow hackers then used to steal proprietary source code from the company before ratting on him. While still on probation for that crime, Mitnick broke into the premises of Pacific Bell and had to go on the run from police in the aftermath, during which time he hacked dozens of systems, including those of IBM, Nokia, Motorola, and Fujitsu.


5.) Tim Berners-Lee:

“Scandalous” is a synonym for “infamous,” and for this legendary computer scientist, knight of the British Empire, and inventor of the World Wide Web to have been a hacker in his school days is certainly a juicy factoid. During his time at Oxford in the mid-’70s, Sir Tim was banned from using university computers after he and a friend were caught hacking their way into restricted digital areas. Luckily by that time he already knew how to make his own computer out of a soldering iron, an old TV, and some spare parts. And also luckily for him, he will always be revered as the father of the Internet.


6.) Neal Patrick and the 414s:

In the early ’80s, hacking was still a relatively foreign concept to most Americans. Few recognized the enormous power hackers could hijack with a few strokes on a keyboard, which explains why a young group of hackers known as the 414s (after a Milwaukee area code) were virtual celebrities after they hacked into the famous Los Alamos National Laboratory, the Memorial Sloan-Kettering Cancer Center, and elsewhere. While today hacking a lab where classified nuclear research is conducted could earn you a one-way ticket to Guantanamo, the 17-year-old ringleader and high school student Neal Patrick was on the cover of Newsweek. The group members got light sentences but prompted Congress to take a stronger role in cybercrime.


7.) Robert T. Morris:

The first ever Internet worm, the Morris Worm derived its name from Cornell grad student Robert Tappan Morris. In 1988, Morris released the worm through MIT’s system to cover his tracks, which would seem to contradict his claims that he meant no harm with it. But that’s exactly what resulted: the worm spread out of control, infecting more than 6,000 computers connected to the ARPANET, the academic forerunner to the World Wide Web. The damages reached as high as an estimated $10 million, and Morris earned the ignominious distinction of being the first person prosecuted under the Computer Fraud and Abuse Act. Morris got community service but was apparently not considered too infamous to be offered his current job as a professor at MIT.


8.) George Hotz:

To some, George Hotz (aka “geohot,” aka “million75,” aka “mil”) is a public menace, a threat to electronic businesses everywhere. To many, Hotz is a hero. The high-schooler shot to fame/infamy in 2007 at the tender age of 17 by giving the world its first hacked, or “jailbroken” iPhone. He traded it for a new sports car and three new iPhones, and the video of the hacking received millions of hits. Apple has had to grudgingly come to terms with jailbreaking, seeing as the courts have declared it legal, but Sony Corp. is definitely not OK with such tampering. When Hotz hacked his PlayStation 3 and published the how-to on the web, the company launched a vicious lawsuit against him. In turn, the hacker group Anonymous launched an attack on Sony, stealing millions of users’ personal info.


9.) Donncha O’Cearbhaill:

According to the FBI, this 19-year-old freshman at Trinity College Dublin is one of the top five most wanted hackers in the world. Well, he was; now that he’s been arrested he’s not really “wanted” anymore. The Feds contend the young man is a VIP member of the Anonymous and LulzSec hacking groups that have already been mentioned and whose targets have included the FBI, the U.S. Senate, and Sony (in the Hotz backlash). It seems “Palladium” (O’Cearbhaill) took the liberty of listening in on a conference call between the FBI and several international police forces who were discussing their investigations of the hacking groups. He could be sentenced to up to 15 years in prison if convicted for that hack alone.


10.) Nicholas Allegra:

Just as George Hotz moved on from the Apple hacking game, Brown University student Nicholas Allegra is also hanging up his jersey. “Comex,” as he is known to millions of rooted iPhone fans, created the simple-to-use Apple iOS jailbreaking program JailbreakMe in 2007 and has since released two newer versions of it. However, Comex seems to have gone over to the dark side, accepting an internship with the very company whose products he became famous exploiting. Still, Allegra’s hacking skills are so advanced (one author puts him five years ahead of the authors of the infamous Stuxnet worm that corrupted Iran’s nuclear facilities) and so many people availed themselves of his talents, he will forever live in hacking infamy. 

takecy 9/10/2012
Mozilla Seeks Designers
Badges for Learning competition

Design digital badges for NASA, Intel, Disney-Pixar, the U.S. Department of Education and other leading organizations in the “Badges for Learning” competition. Deadline for entries is January 17.

Help the world level up with NASA, the MacArthur Foundation and Mozilla.

Mozilla is seeking designers and developers to participate in the $2 million “Badges for Learning” competition. Participants will have the chance to design digital badges for more than 60 different leading organizations, all aimed at providing recognition for learning that happens on the web or outside of school.

Winners will receive funding from the MacArthur Foundation to make their designs a reality, plus the opportunity to collaborate with Mozilla and other leading organizations in education, industry and government.

The goal: supercharge 21st century learning by building a free, open source badge system that helps people around the world use the Web to gain new skills and level up in their life and work.

Learn more or get involved here.

takecy 1/07/2012
Predictions for Google 2012
Predictions for Google 2012

Last year's predictions weren't that great (the predictions for 2010 were better), but predicting the future is an addictive game, so I'll try again. Here are my predictions for 2012:

1. Oflline Google stores that will sell Chromebooks, Android phones, Google TV boxes, Google-branded shirts and more.

2. Google Music will become a subscription service.

3. Google will focus on improving the quality of Android apps. It will offer better tools for creating consistent user interfaces, it will review some of the new apps and applications will be able to request additional permissions after they've been installed.

4. Google Games - a new service for multiplayer games that will combine the best games for Chrome, Android and Google+, while syncing your data, ranking users and allowing you to challenge your friends.

5. A new music editing online service that will only work in Chrome (and probably other Chrome-only services).

6. ARM Chromebooks (notebooks and tablets) and ARM Google TV boxes will be cheaper and more successful.

7. Google+ will have at least 300 million users at the end of 2012 and will incorporate many existing Google apps. Google will aggressively promote the service and will even integrate it with Chrome.

8. Google Instant Answers - an improved OneBox that will offer some of the detailed answers that are available in Wolfram Alpha.

9. A virtual assistant for Android that will be more powerful than Siri and it will also be available in the desktop Google interface as an upgrade for voice search. Google will get better at supporting natural language queries.

10. Google's navigation menu will be customizable and the notification box will support new services.

11. The first Google-branded Motorola phones and tablets.

12. Google search results personalized based on information from your calendar, Google+ posts, the apps you install etc.

13. Google Doodle Creator - a service that lets you create a doodle and share it with your friends.

14. Image Search will be able to analyze images and recognize multiple objects and people.

15. Chrome Web Store apps and extensions for Android.

16. YouTube's HTML5 player will become the default player.

17. YouTube's new TV-like channels will combine some of the best videos that are available.

18. The largest fine in Google's history.

19. Blog commenting service powered by Google+.

20. Google+ Answers service replaces Aardvark.

21. An online Chrome dashboard will let you access your data (bookmarks, passwords, apps) even when you don't use Chrome.

22. Better Google Docs for tablets, Google Drive - a new name for the Google Docs list, apps for syncing files and more free storage.

source : googlesystem

takecy 12/31/2011
DNS Cache Poisoning Attack on Google, Yahoo, Apple
DNS Cache Poisoning Attack on Google,  Yahoo, Apple

Hacker with nickname AlpHaNiX deface Google, Gmail, Youtube, Yahoo, Apple etc domains of Democratic Republic of Congo. Hacker use strategy so-called DNS cache poisoning.

DNS cache poisoning is a security or data integrity compromise in the Domain Name System (DNS). The compromise occurs when data is introduced into a DNS name server's cache database that did not originate from authoritative DNS sources. It may be a deliberate attempt of a maliciously crafted attack on a name server.

DNS Cache Poisoning Attack

Hacked websites are :

  • http://apple.cd/
  • http://yahoo.cd/
  • http://gmail.cd/
  • http://google.cd/
  • http://youtube.cd/
  • http://linux.cd/
  • http://samsung.cd/
  • http://hotmail.cd/
  • http://microsoft.cd/

takecy 12/06/2011
Bitdefender Carrier IQ Detector

The deeply integrated Carrier IQ software on mobile devices has made the rounds lately. Check out this introductory post for detailed information about Carrier IQ. The technology has recently been discovered on Android and Apple smartphones in a way that the discoverer called rootkit-like. Users have a hard time finding out if Carrier IQ is running on their phone, and virtually no possibility of finding out which data it collects or transfers. To top it all off, there is no native option to disable Carrier IQ from running on the phone.

If you are like me, you’d probably want to know if a program that can virtually access all data on the phone is running on it and with which server and companies it communicates.

Bitdefender Carrier IQ Finder is a new program for Android mobile phones by Bitdefender that can be used to find out if the technology is running on a phone.

Android users need to download the application from Android Market where it is available for free. The app has been designed to detect Carrier IQ on Android phones. It cannot remove the technology nor detect or remove malicious software from the phone.

Android users can point their browsers to the Bitdefender carrier IQ Finder market place listing to install the program directly from there. It is necessary to be logged in a Google account to install the app.

The app will search for traces of Carrier IQ on the phone on start up.

Bitdefender Carrier IQ Detector

A red screen after the scan indicates that Carrier IQ has been found running on the system, a green screen that the technology has not been found on the smartphone.

What can you do if Carrier IQ has been found on your phone? It may be virtually impossible to remove the technology completely from the phone. You could contact your carrier for additional information about the technology. (via)

takecy 12/05/2011
Anonymous: We Hacked Cybercops Email
Anonymous: We Hacked Cybercops Email

The Anonymous hacking collective's AntiSec group has launched a fresh assault on law enforcement agencies with the release of what they claim are personal emails stolen from a Californian cybercrime investigator.

The cache of emails – which according to AntiSec are from the account of Fred Baclagan, a retired special agent supervisor of the Californian Department of Justice – includes 30,000 emails detailing various computer forensic techniques and cybercrime investigation protocols.

The hacktivists claim to have hacked into Baclagan's Gmail account and to have accessed his voicemails and SMS message logs using unspecified techniques as part of their ongoing campaign against law enforcement officials and their "allies" in the computer security industry.

The email dump, released as a torrent last Friday in part of what has become the group's regular FuckFBIFriday release, is also said to contain personal information including Baclagan's home address and phone number.

"Possibly the most interesting content in his emails are the IACIS.com* internal email list archives (2005-2011), which detail the methods and tactics cybercrime units use to gather electronic evidence, conduct investigations and make arrests," a member of Anonymous said on a statement accompanying the release, adding that knowledge of these techniques will help hacktivists to develop better tradecraft and anti-forensic techniques.

"There are discussions about using EnCase forensic software, attempts to crack TrueCrypt encrypted drives, sniffing wireless traffic in mobile surveillance vehicles, how to best prepare search warrants and subpoenas, and a whole lot of clueless people asking questions on how to use basic software like FTP. In the end, we rickrolled the entire IACIS list, causing the administrators to panic and shut their list and websites down.

But Baclagan told the Huffington Post that he was nobody special in the Justice Department ... which is what he would say, of course. He said that he had specialised in identity theft before he retired last year. "I'm really just a nobody," he told the Post, "just a local investigator, not involved in anything dynamic or dramatic. ®

Bootnote

*IACIS is the International Association of Computer investigative Specialists, an volunteer-led non-profit organisation made up of law enforcement pros and geared towards developing and etching best practice in computer forensics. (via)

takecy 11/28/2011
Largest DDOS Attack Hit Chinese
Largest DDOS Attack Hit Chinese

A week-long DDoS attack that launched a flood of traffic at an Asian e-commerce company in early November was the biggest such incident so far this year, according to Prolexic, a company that defends websites against such attacks. The distributed denial-of-service attack consisted of four consecutive waves launched from multiple botnets between Nov. 5 and Nov. 12, 2011.

The attack on the unnamed organisation and its DNS provider happened between 5 and 12 November and reached 45Gbit/s at peak, equivalent to 69 million packets or 15,000 connections per second, way above the level that can be easily stemmed using standalone appliances, the company claimed. This attack was three times larger in packets per second volume than the biggest attack Prolexic has mitigated previously, which also occurred in 2011.

Prolexic technicians identified a randomised attack consisting of the largest volume of GET, SYN, ICMP, UDP and DNS floods launched in a single attack campaign this year. They identified that the attack was coming from botnets in multiple worldwide locations.In addition, unlike typical DDoS attacks that are coordinated from one geographic source, this attack was coordinated globally. via

takecy 11/25/2011
Anonymous talks about Anonymous
Anonymous talks about Anonymous

HACKTIVIST GROUP Anonymous, or at least one part of it, has visited Reddit to discuss who it is, where it is and where it's going.

The section of the group that runs the AnonymousIRC Twitter account started the Reddit conversation earlier today, and it discussed things like: its leader - there isn't one; its motives - they are varied; and its members - which are legion.

There might be some disinformation sprinkled around in the conversation, such as the late mention that 9,000 people operate the Twitter account, but otherwise the Reddit session seemed frank and forthcoming. For example, discussing the real numbers behind the account, the group explained that it was managed by "More than one person," adding, "It's impossible to shut down the twitter by arresting a single person."

These is no money behind the group and there are no obvious monetary agendas. Fortunately for the group its methods are cheap, and effective. "We run on a very low budget," said on poster, "but 20 bucks is enough to take on the filthy leaders, fortunately :)".

These cheap and effective methods could lend themselves to attacks on any kind of organisation, like the Opcartel plans to take on a Mexican drugs cartel. This controversial move was backed by some camps and opposed by others. AnonymousIRC said that these Anons were "bold".

"We support them with all our heart, And oops, we may have some data on them which would be preferred to be undisclosed, according to them," it said. "It'll all get out, tho. Why? We do not need to fear Govt's OR Cartels. We're Anonymous and we're mad as hell." It added later, "OpCartel are some ballsy guys. We love them <3".

The disparate nature of the group - and this is just one out of many social media accounts associated with Anonymous, remember - should suggest that there are many disagreements, but it seems that while different sectors may carry out their own initiatives or random attacks, this is fine within the greater Anonymous consciousness.

"We cannot control or limit what some individual anon may do or not do. Neither it is our interest. An example: If some cop finds it funny to mace innocent girls, Internet crowd will hate him. Which will include his family, if that information is public. Like it or not, it's just what happens," one poster said.

"There is no individual Anon. We might agree or not, it does not matter much, though. Anonymous strives because its base is covered every where: Pacifists as well as Anarchists. And while they despise each others methods they still can work together. Isn't it beautiful?"

What might not be so beautiful is the use of the Guy Fawkes or V for Vendettamask that has become the face of the organisation, and one respondent seemed to want to distance the group from its use, or at least its connotations.

"The Guy Fawkes mask became a traditional symbol of Anonymous. We find that troubling for a number of reasons," he or she wrote.

"It's all down to Hollywood. Nobody of us would know of him if it wasn't for the movie. Possibly there was an evil plan. Let's calculate with that - not only to push Time Warners' profits. Most of us don't want to burn down the Parliament. And most of us don't want to throw money into TW's throat. So let us meet halfway."

Other symbols of leadership, such as Topiary who was arrested in the UK, are also dimissed as leaders, but not as personalities. "It does not matter whether Anonymous has a spokesperson or not, even less who that might me. Once you understand you realize it does not matter," adds the poster.

"Barrett Brown is not a spokesperson. Neither is Topiary btw. Or me. Or Sabu. Or whoever. We just keep on pounding the establishment until there is no more."

Majority approval is not necessary for a movement to succeed, but there is a tipping point for action that depends on the mood of the group. This may explain why an operation like that against Facebook was ignored, for technical reasons, but an assault on the Zetas drug cartel was not.

"Nobody within Anonymous can approve or reject any idea. Nobody has that authority. What happens is: Someone suggests a plan. Or an idea. Or an operation. If it is sound, other Anons will support it. If it isn't, it will be ignored. It's a bit like democracy except that it can be taken literally and it is actually working," they said.

"[Facebook] is hosted and backed by Akamai and Amazon, the largest backbone providers you have. It still is possible to screw them but it would take skill and determination. However, those involved in [it] said [the] Op lacked both. You cannot kill [Facebook] with LOIC obviously. Needs different stuff..." µ

takecy 11/10/2011
Adidas Websites Hacked
Adidas Websites Hacked
Adidas has been forced to take some of its main websites offline after a "sophisticated, criminal cyber-attack" that took place last week, the company said.

Adidas.com, reebok.com, miCoach.com and adidas-group.com all were taken offline, along with various local e-commerce sites, the company said in a statement Sunday.

At least two of the sites, adidas.com and miCoach.com, appeared to still be offline Monday evening. "Due to technical difficulties our website is currently not available," said a message at adidas.com.

The sportswear vendor first learned of the attack last Thursday, it said.

"Our preliminary investigation has found no evidence that any consumer data is impacted. But, while we continue our thorough forensic review, we have taken down affected sites ... in order to protect visitors to our sites," it said.

It didn't provide further details of the attacks or say who was responsible. A note on the miCoach website said Adidas hoped to have the site running again by the end of the day Tuesday. via

takecy 11/08/2011
#OccupyLondon : The Night of Thousand Masks
#OccupyLondon : The Night of Thousand Masks

thehackernews.com : Anonymous Mask = "A symbol that unites them behind one universal message" . Activists plan to protest on 5th November ,2011 at Saint Pauls Cathedral London 9:00pm - 11:00pm. This going to be "The Night of Thousand Masks".

Message By Anonymous :

Good evening, London. Allow me first to apologize for this interruption. I do, like many of you, appreciate the comforts of every day routine- the security of the familiar, the tranquility of repetition. I enjoy them as much as any bloke. But in the spirit of commemoration, thereby those important events of the past usually associated with someone's death or the end of some awful bloody struggle, a celebration of a nice holiday, I thought we could mark this November the 5th, a day that is sadly no longer remembered, by taking some time out of our daily lives to sit down and have a little chat. There are of course those who do not want us to speak. I suspect even now, orders are being shouted into telephones, and men with guns will soon be on their way. Why? Because while the truncheon may be used in lieu of conversation, words will always retain their power. Words offer the means to meaning, and for those who will listen, the enunciation of truth. And the truth is, there is something terribly wrong with this country, isn't there? Cruelty and injustice, intolerance and oppression. And where once you had the freedom to object, to think and speak as you saw fit, you now have censors and systems of surveillance coercing your conformity and soliciting your submission. How did this happen? Who's to blame? Well certainly there are those more responsible than others, and they will be held accountable, but again truth be told, if you're looking for the guilty, you need only look into a mirror. I know why you did it. I know you were afraid. Who wouldn't be? War, terror, disease. There were a myriad of problems which conspired to corrupt your reason and rob you of your common sense. Fear got the best of you, and in your panic you turned to the now high chancellor, Adam Sutler. He promised you order, he promised you peace, and all he demanded in return was your silent, obedient consent. Last night I sought to end that silence. Last night I destroyed the Old Bailey, to remind this country of what it has forgotten. More than four hundred years ago a great citizen wished to embed the fifth of November forever in our memory. His hope was to remind the world that fairness, justice, and freedom are more than words, they are perspectives. So if you've seen nothing, if the crimes of this government remain unknown to you then I would suggest you allow the fifth of November to pass unmarked. But if you see what I see, if you feel as I feel, and if you would seek as I seek, then I ask you to stand beside me one year from tonight, outside the gates of Parliament, and together we shall give them a fifth of November that shall never, ever be forgot. V for Vendetta.

takecy 11/05/2011
Girl killed herself on Halloween, Facebook Scam
Scammers have put a new spin on an old Facebook scam, claiming that a girl killed herself on Halloween after her father posted a message on her wall.

Facebook users are sharing messages with their friends, claiming to link to the salacious content.

Girl killed herself on Halloween, Facebook Scam

Girl-Killed-Herself-on-Halloween-After-Dad-Posted-This-on-Her-Wall
[LINK]
This is unbelievable.. shocking..

The messages are currently spreading very quickly on Facebook, as - at the moment at least - Facebook's built-in security systems are not blocking them.

We've seen similar scams in the past, of course, including some which claimed that the girl killed herself on Christmas Eve rather than at Halloween.

Of course, the story is purely designed to lure you into clicking on the link. So what do you see if you do click on the link?

Girl killed herself on Halloween, Facebook Scam

You are taken to a third-party webpage where you are told that in order to view the shocking message left by the father on his late daughter's Facebook wall, you will have to "Share" and "Recommend" the link with your friends.

Woah!! Would you really share and recommend a link before you've actually found out what the content is?

Sadly, lots of Facebook users are so curious that they will do exactly that - helping the message spread for scammers.

And why do the scammers want the message to spread?

Because it drives traffic to online surveys like this, which earn the scammers affiliate commission:

Girl killed herself on Halloween, Facebook Scam

If you were fooled into participating in this scam remove the message from your newsfeed, and delete any messages you may have inadvertently shared with your friends. That way at least you are no longer spreading it with your online chums. (via)

takecy 11/03/2011
Free Domain .in
India Get Online
Google India, in partnership with ICICI Bank and HostGator (the web hosting company), has launched a new program called India Get Online where they make it easy for you to setup a website for your business for free. 

As part of the deal, you get a free .in web domain (provided it is available) and free web hosting for one year. The .in domain will registered to you while Hostgator will manage the website hosting* though you can move the site to any other web host for free. 

Such free offers are always a goldmine for spammers but Google India has made it mandatory for businesses to enter their Permanent Account Number (PAN) or Tax Deduction Account Number (TAN) at the time of registration. Since these numbers are unique for every individual / business, you can’t avail it more than once. 

Your website will be integrated with Google Apps so you also get access to other Google products like Gmail, Google Analytics, Google Docs and more. You also get Google Adwords coupons worth INR 2.5k for free to help you advertise your website on Google and AdSense network sites. 

[*] If you have purchased a web domain already, you can also use Google App Engine to host your website online for free. 

You can visit vijashiviinternational.in or khoslaprinters.in to get an idea of how sites created with the “India Get Online” look like. There’s a set of readymade web templates, pick one that matches your business profile, you can customize the text and pictures of the pages and your site is good to go. 

Google hasn’t exactly specified the amount that businesses will have to pay to renew their website registration and hosting after one year except saying that it will be a “discounted fee.” (via labnol)

takecy
Avast Warns WordPress flaw
Avast Warns WordPress flaw
Security firm Avast is advising webmasters to scan sites and update log-in credentials following the discovery of a malware attack targeting the WordPress publishing platform.

The attack exploits a vulnerability in an image plug-in for WordPress, allowing an attacker to access a site and use the platform to distribute malware payloads and harvest FTP log-in credentials for users and administrators.

Jan Sirmer, senior virus lab researcher at Avast, said that a flaw in the TimThumb image plug-in allows the attackers to infect sites running WordPress with a malicious PHP file.

The attack is believed to be conducted through a commercially available toolkit called BlackHole, and redirect users to sites that attempt to install malware.

Sirmer warned that in some cases the attack had gone unnoticed by administrators because the sites were hosted by third-party service providers.

Avast urged administrators to scan their own systems, and to visit their sites with PCs running anti-virus software to detect possible infections on hosted pages.

"WordPress is not immune to exploitation, a fact driven by its overall popularity and the wide number of available versions," Sirmer said.

"Stronger log-in and password keys, alone or together with two-factor authentication, are options that system administrators should use when working with third-party IT managers." via paketstromsecurity

takecy 11/01/2011
Firefox With Bing Releases
mozillalinks : While Google remains the default search engine for Firefox (not that it is, unanimously, the best choice), Mozilla has announced today a new Firefox edition for USA users that features Bing as the default search engine and Bing.com as the default home page.

firefox with bing

Visitors of firefoxwithbing.com who are already using the latest Firefox will instead be prompted to installBing Search for Firefox, a restartless extension that does just the same: sets Bing as your default search engine and home page.

This is not really as big an announcement if you keep in mind that there are several Firefox editions in the wild already, as a result of partnerships between Mozilla and big names including Twitter, Yahoo,Yandex, and a few others. Some sites however are speculating this may be a sign of changes to come, mainly, Bing becoming the default search engine when Mozilla’s contract with Google ends this November.

Would it be a big change for you? I am guessing not. As a current Firefox user you have probably already set your default search engine and home page, and it is very, deeply incredibly unlikely that Mozilla will change any of these settings for your during an update.

The deal is definitely about new Firefox users (in the order of millions) who would find Bing as the suggested point of entry to the web.

takecy 10/27/2011
ExploitMe Mobile Vulnerable Android and iPhone
The application contains both mobile web and mobile programming defects and we've outlined a set of labs and solutions online to guide you. This tool will help both mobile QA and mobile web developers to learn the kinds of weaknesses that exist in the mobile app space. 

What you're able to learn using ExploitMe Mobile: 

[+] Parameter manipulation of traffic
[+] Insecure communications
[+] Weak password lock screens
[+] Insecure memory management
[+] Weak file system permissions
[+] Insecure storage of files
[+] Insecure logging of information

You can find the full blog overview here with source code links: 

ExploitMe Android Lab setup and walkthroughs:

ExploitMe iPhone Lab setup and walkthroughs:

ExploitMe Mobile Vulnerable Android and iPhone (via)

takecy 10/26/2011
MyBB Downloads Infected
MyBB Downloads Infected

The H-Security: In a blog posting, the MyBB development team has confirmed that the download package for version 1.6.4 of MyBB had been modified to include malicious code. Unknown attackers were able to exploit a vulnerability in the MyBB web site's CMS (content management system) to inject and execute PHP code.

The attackers placed a contaminated version of MyBB, containing a backdoor, on the server. It is unclear exactly when the hack took place, meaning that all downloads of 1.6.4 prior to 6 October could be affected. Users with MyBB systems are advised to check their installations and apply a patch. For rapid disinfection, the developers are advising users to replace the /index.php file with a clean version and to delete the /install/ directory.

The MyBB development team is currently mulling over what conclusions can be drawn from the successful attack. One countermeasure they intend to take is to publish checksums to enable users to check that their downloads are genuine; however, this would not be particularly effective if the attackers have control of the server on which the checksums are store. A better solution would be digital signatures, since these cannot be faked without the secret key – though the problem with digital signatures is that, unless the update system does so automatically, almost no-one ever checks them.

takecy
LG Website Hacked
LG Website Hacked 

One of the Australian websites belonging to global electronics giant LG has been hacked by a collective calling itself the Intra Web Security Exploit Team.

According to Asher Moses of the Sydney Morning Herald, the site, lge dot com dot au, was pwned over the weekend, and was still in embarrassing post-hack distress this morning:

The attackers replaced the site with some lightly-obfuscated JavaScript. The script pretends to be conducting an injection attack as you watch, whilst an expletive-laden track by nerdcore hacker-rapper BeWiz plays in the background.

(The BeWiz track is called TwistedWanted. I'm not sure if that's a reference to Twisted Matrix, the event-driven networking engine written in Python, to UK indie music company Twisted Music, or something else. Listening to BeWiz's whole track was a mission I was unwilling to accept.)

When the simulated attack is complete, the attackers announce, perhaps not without some justification:

It seems as though your website has been hacked.
How did we get past your security?
What security? ;)

takecy 10/25/2011
Microsoft YouTube Channel Hacked

Microsoft YouTube Channel Hacked
Well here is a very shocking news for you all, Industry giant's microsoft channel were hacked this sunday morning according to mashable. All the official videos were removed from the youtube account, The channel had more than 24k subscribers. The channel description was changed to "The channel’s description reads, “I DID NOTHING WRONG I SIMPLY SIGNED INTO MY ACCOUNT THAT I MADE IN 2006 :/.”

I really cannot make any guess on how it was hacked, Whether the hacker keylogged the victim, Or did a phishing attack, or used any zero days.

Microsoft YouTube Channel Hacked (via)

takecy 10/24/2011
Anonymous Take Down 40 Child Porn Websites
Anonymous has taken down more than 40 darknet-based child porn websites over the last week. Details of some of the hacks have been released via pastebin #OpDarknet, including personal details 1500 users of a site named 'Lolita City,' and DDoS tools that target Hidden Wiki and Freedom Hosting — alleged to be two of the biggest darknet sites hosting child porn.

News of the Anonymous campaign to actively target anyone hosting child porn sites comes from statements associated with Anonymous on Pastebin and two Anonymous YouTube video channels. AnonNews has yet to issue a press release.

The AnonMessage and BecomeAnonymous YouTube channels both posted videos with statements of intent to hunt, skin and kill pedobears everywhere, starting with Freedom Hosting.

Unknown 10/23/2011