Latest Hacking News And Events

Pro PoS — This Stealthy Point-of-Sale Malware Could Steal Your Christmas

<div dir="ltr" style="text-align: left;" trbidi="on">
<div class="separator" style="clear: both; text-align: center;">
<a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhcpygoi9H99N_mKBKOJItbOoizLuMeLZfZqvz187z4gPDH8c0QAT8FfCGecU9oUjfggJr9kOdxUDV2s-Wz01-gh7B4-7uq1iA50pZgB2D8NZKZfStCTkMSxTZgk2NxRcPniAWvwMO8OQg/s1600/credit-card-security.jpg" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" height="333" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhcpygoi9H99N_mKBKOJItbOoizLuMeLZfZqvz187z4gPDH8c0QAT8FfCGecU9oUjfggJr9kOdxUDV2s-Wz01-gh7B4-7uq1iA50pZgB2D8NZKZfStCTkMSxTZgk2NxRcPniAWvwMO8OQg/s640/credit-card-security.jpg" width="640" /></a></div>
<div style="text-align: justify;">
</div>
<div style="text-align: justify;">
<span style="font-family: "georgia" , "times new roman" , serif;">The 
point of Sale systems are the most tempting target for cyber crooks to 
steal your credit card information and with this Christmas, you need to 
be more careful while using your credit cards at retailers and grocery 
stores.</span></div>
<span style="font-family: "georgia" , "times new roman" , serif;">
</span>
<br />
<script async="" src="//pagead2.googlesyndication.com/pagead/js/adsbygoogle.js"></script>

<br />
<ins class="adsbygoogle" data-ad-client="ca-pub-7726750987177406" data-ad-format="auto" data-ad-slot="7596682374" style="display: block;"></ins><script>
(adsbygoogle = window.adsbygoogle || []).push({});
</script>

<div style="text-align: justify;">
<span style="font-family: "georgia" , "times new roman" , serif;"><b>Here's why… </b></span></div>
<span style="font-family: "georgia" , "times new roman" , serif;">
</span>
<div style="text-align: justify;">
<span style="font-family: "georgia" , "times new roman" , serif;">
Cyber criminals are now selling a new powerful strain of Point of Sale (PoS) malware through underground forums.</span></div>
<span style="font-family: "georgia" , "times new roman" , serif;">
</span>
<br />
<div style="text-align: justify;">
<span style="font-family: "georgia" , "times new roman" , serif;">
Like several POS malware families discovered last year, including vSkimmer and BlackPOS, the new malware is also designed to steal payment card data from the infected POS systems and <b>support TOR </b>to hide its C&C (Command and Control) servers.</span></div>
<div style="text-align: justify;">
</div>
<div style="text-align: justify;">
<span style="font-family: "georgia" , "times new roman" , serif;"><span class="main-article-info"></span></span><br />
<h3 style="text-align: justify;">
<span style="font-family: "georgia" , "times new roman" , serif;"><span class="main-article-info">
Pro PoS – Light Weight, Yet Powerful Malware</span></span></h3>
<span style="font-family: "georgia" , "times new roman" , serif;"><span class="main-article-info">
</span></span>
<br />
<div style="text-align: justify;">
<script async="" src="//pagead2.googlesyndication.com/pagead/js/adsbygoogle.js"></script>

<br />
<ins class="adsbygoogle" data-ad-client="ca-pub-7726750987177406" data-ad-format="auto" data-ad-slot="7596682374" style="display: block;"></ins><script>
(adsbygoogle = window.adsbygoogle || []).push({});
</script>
</div>
<span style="font-family: "georgia" , "times new roman" , serif;"><span class="main-article-info">
</span></span>
<br />
<div style="text-align: justify;">
<span style="font-family: "georgia" , "times new roman" , serif;"><span class="main-article-info">However, the new malware, dubbed "<b>Pro PoS</b>," packs more than just a PoS malware.</span></span></div>
<span style="font-family: "georgia" , "times new roman" , serif;"><span class="main-article-info">
</span></span>
<div style="text-align: justify;">
</div>
<span style="font-family: "georgia" , "times new roman" , serif;"><span class="main-article-info">
<div style="text-align: justify;">
Pro PoS weighs only 76KB, implements rootkit functionalities, as well as
 mechanisms to avoid antivirus detection, according to threat 
intelligence firm InfoArmor.</div>
<div style="text-align: justify;">
</div>
<div style="text-align: justify;">
What's even more interesting about this malware is…</div>
<div style="text-align: justify;">
</div>
<div style="text-align: justify;">
Pro PoS integrates a <b>polymorphic engine </b>that lets the threat generate a different signature for each malware sample – a measure designed to foil security defences.</div>
<div style="text-align: justify;">
</div>
<div style="text-align: justify;">
InfoArmor warned that cyber crooks were actively using the current version of <b>Pro PoS Solution</b> in an effort to target PoS systems used by large retailers and SMBs in the United States and Canada specifically.</div>
<div style="text-align: justify;">
</div>
<h3 style="text-align: justify;">
Pro PoS Malware found in the Wild</h3>
<div style="text-align: justify;">
</div>
<div style="text-align: justify;">
The developers of the Pro PoS malware are believed to be hackers from Eastern Europe, according to the security firm.</div>
<div style="text-align: justify;">
</div>
<div style="text-align: justify;">
On November 27 (<b>Black Friday</b>), researchers at InfoArmor noticed a significant increase in the price of the Pro PoS Solution, which was offered at <b>$2,600 </b>for a six-month licence.</div>
<div style="text-align: justify;">
</div>
<div style="text-align: justify;">
The developers of Pro PoS have designed their malware in such a way that
 it infects the principal operating systems, including newer operating 
systems, used by the companies in the retail environment.</div>
</span></span><span style="font-family: "georgia" , "times new roman" , serif;"> </span></div>
</div>

Hacker Hacking news Latest News Security news Pro PoS — This Stealthy Point-of-Sale Malware Could Steal Your Christmas

The point of Sale systems are the most tempting target for cyber crooks to steal your credit card information and with this Christma...

Critical 'Port Fail' Vulnerability Reveals Real IP Addresses of VPN Users

9:20 PM Unknown 0

<div dir="ltr" style="text-align: left;" trbidi="on">
<div class="separator" style="clear: both; text-align: center;">
<a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjysD8aD63_udawCkQwXO0jmzMJ32kKgA4V6Oz14-WSXQ0x0zAp4KCkavwbj1DHU5Zk-kVNaf5f2YfZk5yC3g4AuwFSPo_rcuyE2e6avv3d2_6zW4yyvJHVSo-oJ2149J6PgEsE7aa7DUg/s1600/vpn-hacking.png" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" height="334" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjysD8aD63_udawCkQwXO0jmzMJ32kKgA4V6Oz14-WSXQ0x0zAp4KCkavwbj1DHU5Zk-kVNaf5f2YfZk5yC3g4AuwFSPo_rcuyE2e6avv3d2_6zW4yyvJHVSo-oJ2149J6PgEsE7aa7DUg/s640/vpn-hacking.png" width="640" /></a></div>
<div style="text-align: justify;">
<span style="font-family: Georgia,"Times New Roman",serif;"> </span></div>
<div style="text-align: justify;">
<span style="font-family: Georgia,"Times New Roman",serif;">A 
newly discovered flaw affecting all VPN protocols and operating systems 
has the capability to reveal the real IP-addresses of users' computers, 
including BitTorrent users, with relative ease.</span></div>
<span style="font-family: Georgia,"Times New Roman",serif;">
</span><div style="text-align: justify;">
<span style="font-family: Georgia,"Times New Roman",serif;"><br /></span></div>
<span style="font-family: Georgia,"Times New Roman",serif;">
</span><div style="text-align: justify;">
<span style="font-family: Georgia,"Times New Roman",serif;">
The vulnerability, dubbed <b>Port Fail </b>by VPN provider Perfect 
Privacy (PP) who discovered the issue, is a simple port forwarding trick
 and affects those services that:</span></div>
<span style="font-family: Georgia,"Times New Roman",serif;">
</span><ul style="text-align: left;">
<li style="text-align: justify;"><span style="font-family: Georgia,"Times New Roman",serif;">Allow port forwarding</span></li>
<br />
<script async src="//pagead2.googlesyndication.com/pagead/js/adsbygoogle.js"></script>

<ins class="adsbygoogle"
     style="display:block"
     data-ad-client="ca-pub-7726750987177406"
     data-ad-slot="7596682374"
     data-ad-format="auto"></ins>
<script>
(adsbygoogle = window.adsbygoogle || []).push({});
</script>
<br />
<li style="text-align: justify;"><span style="font-family: Georgia,"Times New Roman",serif;">Have no protection against this specific attack</span></li>
</ul>
<span style="font-family: Georgia,"Times New Roman",serif;">
</span><div style="text-align: justify;">
<span style="font-family: Georgia,"Times New Roman",serif;">
Port Forwarding trick means if an attacker uses the same VPN (<b>Virtual Private Network</b>) as the victim, then the real IP-address of the victim can be exposed by forwarding Internet traffic to a specific port.</span></div>
<span style="font-family: Georgia,"Times New Roman",serif;">
</span><blockquote style="text-align: justify;">
<span style="font-family: Georgia,"Times New Roman",serif;"><i>"The crucial issue here is that a VPN user connecting to his own VPN 
server will use his default route with his real IP address, as this is 
required for the VPN connection to work," </i>Perfect Privacy wrote in a <a href="https://www.perfect-privacy.com/blog/2015/11/26/ip-leak-vulnerability-affecting-vpn-providers-with-port-forwarding/" rel="nofollow" target="_blank">blog post</a> on Thursday.</span></blockquote>
<span style="font-family: Georgia,"Times New Roman",serif;"><span class="main-article-info"></span></span><br />
<div style="text-align: justify;">
Port Fail affects all VPN protocols including…</div>
<ul style="text-align: left;">
<li style="text-align: justify;">OpenVPN</li>
<li style="text-align: justify;">IPSec</li>
</ul>
<div style="text-align: justify;">
…as well as applies to all operating systems, posing a huge privacy risk. </div>
<h3 style="text-align: justify;">
How Does 'Port Fail' Work?</h3>
<div style="text-align: justify;">
A successful IP address leak attack requires an attacker to be on the 
same VPN network as the victim and to know the victim's VPN exit IP 
address, which could be discovered by tricking a victim into visiting a 
website control controlled by the attacker.</div>
<div style="text-align: justify;">
</div>
<div style="text-align: justify;">
For example, an attacker with port forwarding enabled can see the 
request from the victim's actual IP addresses by tricking the victim 
into opening an image file. </div>
<div style="text-align: justify;">
</div>
<br />
<script async src="//pagead2.googlesyndication.com/pagead/js/adsbygoogle.js"></script>

<ins class="adsbygoogle"
     style="display:block"
     data-ad-client="ca-pub-7726750987177406"
     data-ad-slot="7596682374"
     data-ad-format="auto"></ins>
<script>
(adsbygoogle = window.adsbygoogle || []).push({});
</script>
<br />
<div style="text-align: justify;">
The same attack is possible for<b> BitTorrent users</b>, but, in this case, there is no need for the attacker to redirect the victim to their page. </div>
<div style="text-align: justify;">
</div>
<div style="text-align: justify;">
In this case, the attacker only with the activated port forwarding for 
the default BitTorrent port, can expose the real IP-address of a VPN 
user on the same network.</div>
<br />
<span style="font-family: Georgia,"Times New Roman",serif;"><span class="main-article-info"></span></span><br />
<h3 style="text-align: justify;">
Affected VPN Providers</h3>
<div style="text-align: justify;">
The flaw affected various large VPN providers. Perfect Privacy tested 
nine VPN providers out of which five were found to be vulnerable to this
 flaw and were alerted last week. </div>
<div style="text-align: justify;">
</div>
<div style="text-align: justify;">
VPN providers including Private Internet Access (PIA), Ovpn.to and nVPN have fixed the issue before publication.</div>
<div style="text-align: justify;">
</div>
<div style="text-align: justify;">
However, the company warned, <i>"other VPN providers may be vulnerable to this attack as we could not possibly test all."</i></div>
<div style="text-align: justify;">
</div>
<br />
<script async src="//pagead2.googlesyndication.com/pagead/js/adsbygoogle.js"></script>

<ins class="adsbygoogle"
     style="display:block"
     data-ad-client="ca-pub-7726750987177406"
     data-ad-slot="7596682374"
     data-ad-format="auto"></ins>
<script>
(adsbygoogle = window.adsbygoogle || []).push({});
</script>
<br />
<div style="text-align: justify;">
VPN aims to make you sure that your real identity remains anonymous on 
the Internet so that nobody could track the origin of your connection 
back to you, but this newly discovered flaw shows that it's quite easy 
to bypass this on some VPN providers.</div>
<span style="font-family: Georgia,"Times New Roman",serif;"> </span></div>

Hacker Hacking news Latest News Security news Vulnerabilities Critical 'Port Fail' Vulnerability Reveals Real IP Addresses of VPN Users

A newly discovered flaw affecting all VPN protocols and operating systems has the capability to reveal the real IP-addresses of us...

Millions of IoT Devices Using Same Hard-Coded CRYPTO Keys

9:01 PM Unknown 0

<div dir="ltr" style="text-align: left;" trbidi="on">
<div class="separator" style="clear: both; text-align: center;">
<a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEh9TDTs8upavk0DL-Vk6caK-rdSwDfMh0TGGwGjdcuOIMDax-eORTd_QPuK8xXdNUWuXpBcge0gIs3u2kh8yOvNaoXUvJRxY-g0SY5bTFK8zX2KRZVLAmNEyTq0fPO1FX4FJq4jk2oZppQ/s1600/CRYPTO-KEYS.png" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" height="333" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEh9TDTs8upavk0DL-Vk6caK-rdSwDfMh0TGGwGjdcuOIMDax-eORTd_QPuK8xXdNUWuXpBcge0gIs3u2kh8yOvNaoXUvJRxY-g0SY5bTFK8zX2KRZVLAmNEyTq0fPO1FX4FJq4jk2oZppQ/s640/CRYPTO-KEYS.png" width="640" /></a></div>
<div style="text-align: justify;">
<span style="font-family: Georgia,"Times New Roman",serif;"> </span></div>
<div style="text-align: justify;">
<span style="font-family: Georgia,"Times New Roman",serif;">Millions of embedded devices, including home routers, modems, IP cameras, VoIP phones, are shareing the same hard-coded <b>SSH</b> (Secure Shell) cryptographic keys or <b>HTTPS</b> (HTTP Secure) server certificates that expose them to various types of malicious attacks.</span></div>
<span style="font-family: Georgia,"Times New Roman",serif;">
</span><div style="text-align: justify;">
<span style="font-family: Georgia,"Times New Roman",serif;">
</BR>
<script async src="//pagead2.googlesyndication.com/pagead/js/adsbygoogle.js"></script>

<ins class="adsbygoogle"
     style="display:block"
     data-ad-client="ca-pub-7726750987177406"
     data-ad-slot="7596682374"
     data-ad-format="auto"></ins>
<script>
(adsbygoogle = window.adsbygoogle || []).push({});
</script><br /></span></div>
<span style="font-family: Georgia,"Times New Roman",serif;">
</span><div style="text-align: justify;">
<span style="font-family: Georgia,"Times New Roman",serif;">
A new analysis by IT security consultancy <i>SEC Consult </i>shows that 
the lazy manufacturers of the Internet of Things (IoTs) and Home Routers
 are reusing the same set of hard-coded cryptographic keys, leaving 
devices open to Hijacking.</span></div>
<span style="font-family: Georgia,"Times New Roman",serif;">
</span><div style="text-align: justify;">
<span style="font-family: Georgia,"Times New Roman",serif;"><br /></span></div>
<span style="font-family: Georgia,"Times New Roman",serif;">
</span><div style="text-align: justify;">
<span style="font-family: Georgia,"Times New Roman",serif;">
In simple words, this means that if you are able to access one device 
remotely, you can possibly log into hundreds of thousands of other 
devices – including the devices from different manufacturers.</span></div>
<div style="text-align: justify;">
<h3 style="text-align: justify;">
<span style="font-family: Georgia,"Times New Roman",serif;">
Re-Using Same Encryption Keys</span></h3>
<div style="text-align: justify;">
<span style="font-family: Georgia,"Times New Roman",serif;">
In its <a href="http://blog.sec-consult.com/2015/11/house-of-keys-industry-wide-https.html" rel="nofollow" target="_blank">survey of IoT devices</a>,
 the company studied 4,000 embedded devices from 70 different hardware 
vendors, ranging from simple home routers to Internet gateway servers, 
and discovered that…</span></div>
<div style="text-align: justify;">
<span style="font-family: Georgia,"Times New Roman",serif;">
</br>
<script async src="//pagead2.googlesyndication.com/pagead/js/adsbygoogle.js"></script>

<ins class="adsbygoogle"
     style="display:block"
     data-ad-client="ca-pub-7726750987177406"
     data-ad-slot="7596682374"
     data-ad-format="auto"></ins>
<script>
(adsbygoogle = window.adsbygoogle || []).push({});
</script><br /></span></div>
<div style="text-align: justify;">
<span style="font-family: Georgia,"Times New Roman",serif;">
…over 580 unique private cryptographic keys for SSH and HTTPS are 
re-shared between multiple devices from the same vendor and even from 
the different vendors.</span></div>
<div style="text-align: justify;">
<span style="font-family: Georgia,"Times New Roman",serif;"><br /></span></div>
<div style="text-align: justify;">
<span style="font-family: Georgia,"Times New Roman",serif;">
The most common use of these static keys are:</span></div>
<div style="text-align: justify;">
</div>
<ul>
<li><span style="font-family: Georgia,"Times New Roman",serif;"><b>SSH host keys</b></span></li>
<li><span style="font-family: Georgia,"Times New Roman",serif;"><b>X.509 HTTPS certificates</b></span></li>
</ul>
<div style="text-align: justify;">
<span style="font-family: Georgia,"Times New Roman",serif;">
SSH host keys verify the identity of a device that runs an SSH server 
using a public-private key pair. If an attacker steals the device's SSH 
host private key, he/she can impersonate the device and trick the 
victim's computer to talk to his computer instead.</span>
</div>
<span style="font-family: Georgia,"Times New Roman",serif;"> </span></div>
<div style="text-align: justify;">
<div style="text-align: justify;">
<span style="font-family: Georgia,"Times New Roman",serif;">
The same happens in the case of websites if an attacker gains access to 
the device's HTTPS private certificate, which is actually used to 
encrypt traffic between users and its Web-based management interface.</span></div>
<div style="text-align: justify;">
<span style="font-family: Georgia,"Times New Roman",serif;"><br /></span></div>
<div style="text-align: justify;">
<span style="font-family: Georgia,"Times New Roman",serif;">
The attacker can then decrypt the traffic to extract usernames, 
passwords and other sensitive data with the help of device's HTTPS 
private key.</span></div>
<h3 style="text-align: justify;">
<span style="font-family: Georgia,"Times New Roman",serif;">
MILLLLLIONS of Devices Open to Attacks</span></h3>
<div style="text-align: justify;">
<span style="font-family: Georgia,"Times New Roman",serif;">
When scanned the Internet for those 580 keys, the researchers found that
 at least 230 crypto keys are actively being used by more than 4 Million
 IoT devices.</span></div>
<br />
<script async src="//pagead2.googlesyndication.com/pagead/js/adsbygoogle.js"></script>

<ins class="adsbygoogle"
     style="display:block"
     data-ad-client="ca-pub-7726750987177406"
     data-ad-slot="7596682374"
     data-ad-format="auto"></ins>
<script>
(adsbygoogle = window.adsbygoogle || []).push({});
</script>
<br />
<div style="text-align: justify;">
<span style="font-family: Georgia,"Times New Roman",serif;"><br /></span></div>
<div style="text-align: justify;">
<span style="font-family: Georgia,"Times New Roman",serif;">
Moreover, the researchers recovered around 150 HTTPS server certificates
 that are used by 3.2 Million devices, along with 80 SSH host keys that 
are used by at least 900,000 devices.</span></div>
<div style="text-align: justify;">
<span style="font-family: Georgia,"Times New Roman",serif;"><br /></span>
</div>
<div style="text-align: justify;">
<div style="text-align: justify;">
<span style="font-family: Georgia,"Times New Roman",serif;">
The remaining crypto keys might be used by various other devices that 
are not connected to the Internet, but could still be vulnerable to <b>man-in-the-middle (MITM) attacks </b>within their respective local area networks.</span></div>
<div style="text-align: justify;">
<span style="font-family: Georgia,"Times New Roman",serif;"><br /></span></div>
<div style="text-align: justify;">
<span style="font-family: Georgia,"Times New Roman",serif;">
As a result, potentially Millions of Internet-connected devices can be 
logged into by attackers, or their HTTPS web server connections can 
silently be decrypted by MitM attackers, using these crypto keys and 
certs once they're extracted from their firmware.</span></div>
<div style="text-align: justify;">
<span style="font-family: Georgia,"Times New Roman",serif;"><br /></span></div>
<h3 style="text-align: justify;">
<span style="font-family: Georgia,"Times New Roman",serif;">
Where Does the actual Problem Reside?</span></h3>
<div style="text-align: justify;">
<span style="font-family: Georgia,"Times New Roman",serif;"><br /></span></div>
<div style="text-align: justify;">
<span style="font-family: Georgia,"Times New Roman",serif;">
The issue lies in the way vendors build and deploy their products. 
Typically, the vendors built their device's firmware based on <b>software development kits </b>(SDKs) received from chipmakers…</span></div>
<div style="text-align: justify;">
<span style="font-family: Georgia,"Times New Roman",serif;"><br /></span></div>
<div style="text-align: justify;">
<span style="font-family: Georgia,"Times New Roman",serif;">
…without even bothering to change the source code or even the keys or certificates that are already present in those SDKs.</span></div>
<div style="text-align: justify;">
<span style="font-family: Georgia,"Times New Roman",serif;"><br /></span></div>
<div style="text-align: justify;">
<span style="font-family: Georgia,"Times New Roman",serif;">
There are many reasons why this large number of devices are accessible from the Internet via HTTPS and SSH. These include:</span></div>
<div style="text-align: justify;">
</div>
<ul>
<li><span style="font-family: Georgia,"Times New Roman",serif;">Insecure default configurations by vendors</span></li>
<li><span style="font-family: Georgia,"Times New Roman",serif;">Automatic port forwarding via UPnP</span></li>
<li><span style="font-family: Georgia,"Times New Roman",serif;">Provisioning by ISPs that configure their subscribers' devices for remote management</span></li>
</ul>
<blockquote style="text-align: justify;">
<span style="font-family: Georgia,"Times New Roman",serif;"><i>"The source of the keys is an interesting aspect. Some keys are only 
found in one product or several products in the same product line. In 
other cases we found the same keys in products from various vendors,"</i> Sec Consult wrote in its <a href="http://blog.sec-consult.com/2015/11/house-of-keys-industry-wide-https.html" rel="nofollow" target="_blank">blog post</a>.</span></blockquote>
<h3 style="text-align: justify;">
<span style="font-family: Georgia,"Times New Roman",serif;">
List of Vendors that are Re-Using Encryption Keys</span></h3>
<div style="text-align: justify;">
<span style="font-family: Georgia,"Times New Roman",serif;">
Although SEC Consult identified more than 900 vulnerable products from 
roughly 50 manufacturers, the actual number could be even higher 
considering that its study only targeted firmware the company had access
 to.</span></div>
<div style="text-align: justify;">
<span style="font-family: Georgia,"Times New Roman",serif;"> </span></div>
<div style="text-align: justify;">
<span style="font-family: Georgia,"Times New Roman",serif;"><span class="main-article-info"><div style="text-align: justify;">
According to SEC Consult, these are the companies that were found reusing encryption keys:</div>
<blockquote style="text-align: justify;">
ADB, AMX, Actiontec, Adtran, Alcatel-Lucent, Alpha Networks, Aruba 
Networks, Aztech, Bewan, Busch-Jaeger, CTC Union, Cisco, Clear, 
Comtrend, D-Link, Deutsche Telekom, DrayTek, Edimax, General Electric 
(GE), Green Packet, Huawei, Infomark, Innatech, Linksys, Motorola, Moxa,
 NETGEAR, NetComm Wireless, ONT, Observa Telecom, Opengear, Pace, 
Philips, Pirelli , Robustel, Sagemcom, Seagate, Seowon Intech, Sierra 
Wireless, Smart RG, TP-LINK, TRENDnet, Technicolor, Tenda, Totolink, 
unify, UPVEL, Ubee Interactive, Ubiquiti Networks, Vodafone, Western 
Digital, ZTE, Zhone and ZyXEL.</blockquote>
<h3 style="text-align: justify;">
Most Affected Countries</h3>
<div style="text-align: justify;">
Here's the list of Top 10 countries that are affected by SSH/HTTPS encryption key reuse:</div>
<div style="text-align: justify;">
</div>
<ul>
<li>United States</li>
<li>Mexico</li>
<li>Brazil</li>
<li>Spain</li>
<li>Colombia</li>
<li>Canada</li>
<li>China</li>
<li>Russian Federation</li>
<li>Taiwan</li>
<li>United Kingdom</li>
</ul>
<div style="text-align: justify;">
SEC Consult has<i> "worked together with CERT/CC to address this issue since early August 2015."</i> and it recommends vendors to use securely random cryptographic keys for each IoT-capable device.</div>
<div style="text-align: justify;">
</div>
<div style="text-align: justify;">
Moreover, ISPs are advised to make sure that there is no possibility to 
remotely access CPE (customer premises equipment) devices via WAN port. 
In case they need access for remote support purposes, <i>"setting up a dedicated management VLAN with strict ACLs is recommended."</i></div>
</span></span><span style="font-family: Georgia,"Times New Roman",serif;"> </span></div>
</div>
<span style="font-family: Georgia,"Times New Roman",serif;"> </span></div>
</div>

Hacker Hacking news Latest News Security news Millions of IoT Devices Using Same Hard-Coded CRYPTO Keys

Millions of embedded devices, including home routers, modems, IP cameras, VoIP phones, are shareing the same hard-coded SSH (Secure...

Hackers Can Remotely Record and Listen Calls from Your Samsung Galaxy Phones

10:31 PM Unknown 0

Hacker Hacking news Latest News Security news Smartphone Hackers Can Remotely Record and Listen Calls from Your Samsung Galaxy Phones

If you own a Samsung Galaxy Phone – S6, S6 Edge or Note 4 , in particular – there are chances that a skilled hacker could remotel...

"Teen" Hackers Strike Again, Leak Info of Government Employees

12:54 AM Unknown 0

<div dir="ltr" style="text-align: left;" trbidi="on">
<div class="separator" style="clear: both; text-align: center;">
<a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjR4lZLtQbm9WqMYulNfxtSHM2fvbEfgpFsJgBdooHV3hTUAaMyC0N_W9rfI6VsxVlMb5zd0LSQxH7bw4R0N759VE6RCUf9u0I7Ti2jzbQxdv0mbepKJYpVwKAERqciW23EYWM9gvYJCx0/s1600/Teen-Hackers-Strike-Again-Leak-Info-of-Government-Employees.jpg" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" height="394" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjR4lZLtQbm9WqMYulNfxtSHM2fvbEfgpFsJgBdooHV3hTUAaMyC0N_W9rfI6VsxVlMb5zd0LSQxH7bw4R0N759VE6RCUf9u0I7Ti2jzbQxdv0mbepKJYpVwKAERqciW23EYWM9gvYJCx0/s640/Teen-Hackers-Strike-Again-Leak-Info-of-Government-Employees.jpg" width="640" /></a></div>
<span style="font-family: Georgia,"Times New Roman",serif;">The same "stoner teens" who hacked CIA director John Brennan's AOL account are back. Today, "Crackas With Attitude" posted the contact information of government employees online-and they claim to have accessed far more than that. </span><br />
<br />
<span style="font-family: Georgia,"Times New Roman",serif;">"34,000 lines of emails, names, position and phone numbers of gov 
associates, including military," one of the hackers bragged about how 
many government names they bagged. His account is now <a href="https://twitter.com/phphax" rel="nofollow" target="_blank">deleted</a>. Motherboard <a href="http://motherboard.vice.com/read/teenage-hackers-say-theyve-doxxed-more-than-3500-government-employees" rel="nofollow" target="_blank">spoke to the hackers</a>, who claim they gained access to a lot more than the information shared today:</span>
<br />
<script async src="//pagead2.googlesyndication.com/pagead/js/adsbygoogle.js"></script>

<ins class="adsbygoogle"
     style="display:block"
     data-ad-client="ca-pub-7726750987177406"
     data-ad-slot="7596682374"
     data-ad-format="auto"></ins>
<script>
(adsbygoogle = window.adsbygoogle || []).push({});
</script><br />
<blockquote>
<span style="font-family: Georgia,"Times New Roman",serif;">Earlier
 on Thursday, Cracka told Motherboard that the group hacked into 
someone's account, and got access to several "tools feds use" such as <a href="http://www.justice.gov/sites/default/files/jmd/legacy/2014/06/27/jabs.pdf" rel="nofollow" target="_blank">JABS</a>, a database of arrested people, <a href="http://www.ic3.gov/about/default.aspx" rel="nofollow" target="_blank">IC3</a>, an FBI crime-reporting tool, and <a href="https://www.fbi.gov/about-us/cjis/leep-law-enforcement-enterprise-portal/vcc_sig" rel="nofollow" target="_blank">VCC</a>,
 a sharing tool for law enforcement agencies. He declined to say whose 
account they hijacked, only that the owner is someone "high in the 
[government]."</span></blockquote>
<span style="font-family: Georgia,"Times New Roman",serif;">I called some of the numbers of 
government employees, from FBI agents to local law enforcement, and they
 were accurate. That doesn't prove CWA's second dump was legit, since 
there's always a chance CWA could've found the information by other 
means than hacking. Then again, what they released the first time <a href="https://wikileaks.org/cia-emails/" rel="nofollow" target="_blank">turned out to be real</a>. </span>
<br />
<script async src="//pagead2.googlesyndication.com/pagead/js/adsbygoogle.js"></script>

<ins class="adsbygoogle"
     style="display:block"
     data-ad-client="ca-pub-7726750987177406"
     data-ad-slot="7596682374"
     data-ad-format="auto"></ins>
<script>
(adsbygoogle = window.adsbygoogle || []).push({});
</script><br />
</div>

Hacker Hacking news Latest News Security news "Teen" Hackers Strike Again, Leak Info of Government Employees

The same "stoner teens" who hacked CIA director John Brennan's AOL account are back. Today, "Crackas With Attitude...

Flaw in SAP Firm's XSS Filter Exposed Many Sites to Attacks

9:55 PM Unknown 0

<div dir="ltr" style="text-align: left;" trbidi="on">
<div class="separator" style="clear: both; text-align: center;">
<a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgc-ABeEfVK9yAbS0gOECavp8dD9pzXk8l7dR728UDDfyYm0bMnSudPQsyVKAvUgUJiHiWalMmc3EyCTVqpMkRn3b9JWPT5TunW8QBGFiTq4w9UD-3B6pGy70a2WvC4L7tioKBVEWGEsvo/s1600/image-59545-panoV9free-pcqg-59545.jpg" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" height="306" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgc-ABeEfVK9yAbS0gOECavp8dD9pzXk8l7dR728UDDfyYm0bMnSudPQsyVKAvUgUJiHiWalMmc3EyCTVqpMkRn3b9JWPT5TunW8QBGFiTq4w9UD-3B6pGy70a2WvC4L7tioKBVEWGEsvo/s640/image-59545-panoV9free-pcqg-59545.jpg" width="640" /></a></div>
<br />
<br />
<div style="background-color: white; color: #333333; font-family: Verdana, Arial, Helvetica, sans-serif; font-size: 12px; line-height: 20px;">
<strong><span style="font-size: small;"><span style="font-family: 'trebuchet ms', geneva;">Roughly one hundred websites were exposed to cross-site scripting (XSS) attacks because an XSS filter used on some of their web pages could have been easily bypassed, a researcher reported on Sunday.</span></span></strong></div>
<div style="background-color: white; color: #333333; font-family: Verdana, Arial, Helvetica, sans-serif; font-size: 12px; line-height: 20px;">
<strong><span style="font-size: small;"><span style="font-family: 'trebuchet ms', geneva;"><br /></span></span></strong></div>
<div style="background-color: white; color: #333333; font-family: Verdana, Arial, Helvetica, sans-serif; font-size: 12px; line-height: 20px;">
<span style="font-size: small;"><span style="font-family: 'trebuchet ms', geneva;">Ashar Javed, a security researcher who specializes in finding tricky XSS vulnerabilities,<a href="https://respectxss.blogspot.de/2015/11/a-tale-of-breaking-saps-successfactorss.html" style="color: #0076b4; font-weight: bold; text-decoration: none;" target="_blank">identified a reflected XSS flaw</a> on a website used by Germany-based enterprise software maker SAP to list jobs available within the company.</span></span></div>
<div style="background-color: white; color: #333333; font-family: Verdana, Arial, Helvetica, sans-serif; font-size: 12px; line-height: 20px;">
<span style="font-size: small;"><span style="font-family: 'trebuchet ms', geneva;">While the affected page was protected by an XSS filter to prevent attacks, the expert discovered that developers had failed to escape certain strings, such as <em><span style="color: red;"></</span></em> and <span style="color: red;"><em>'</em></span>, when sanitizing user input. This oversight could have allowed attackers to inject specially crafted XSS payloads into the website.</span></span></div>
<div style="background-color: white; color: #333333; font-family: Verdana, Arial, Helvetica, sans-serif; font-size: 12px; line-height: 20px;">
<span style="font-size: small;"><span style="font-family: 'trebuchet ms', geneva;"><br /></span></span></div>
<div style="background-color: white; color: #333333; font-family: Verdana, Arial, Helvetica, sans-serif; font-size: 12px; line-height: 20px;">
<span style="font-size: small;"><span style="font-family: 'trebuchet ms', geneva;">After conducting some tests, Javed discovered that <em><span style="color: red;"></</span></em> could not be used for XSS attacks since the "<span style="color: black;"></script><em>"</em></span> string was blocked, but the single quotation mark had been used by developers for “if” conditions, allowing the use of XSS payloads such as <em><span style="color: red;">‘-confirm(1)-’</span></em>.</span></span></div>
<div style="background-color: white; color: #333333; font-family: Verdana, Arial, Helvetica, sans-serif; font-size: 12px; line-height: 20px;">
<span style="font-size: small;"><span style="font-family: 'trebuchet ms', geneva;">In this example, the JavaScript “confirm” function is used to display a dialog box containing the message “1” along with OK and Cancel buttons. However, the expert told <em>SecurityWeek</em>that other functions could have been used as well.</span></span></div>
<div style="background-color: white; color: #333333; font-family: Verdana, Arial, Helvetica, sans-serif; font-size: 12px; line-height: 20px;">
<span style="font-size: small;"><span style="font-family: 'trebuchet ms', geneva;">After reporting his findings to SAP at the software giant’s Product Security Expert Summit in March, Javed learned that the flawed XSS filter belongs to SuccessFactors, a SAP-owned company that provides cloud-based human capital management solutions.</span></span></div>
<div style="background-color: white; color: #333333; font-family: Verdana, Arial, Helvetica, sans-serif; font-size: 12px; line-height: 20px;">
<span style="font-size: small;"><span style="font-family: 'trebuchet ms', geneva;">The expert identified the buggy XSS filter on roughly 100 websites, many of which belong to high profile companies. Javed believes the filter is part of SuccessFactors’ product, which is also suggested by the fact that the vulnerable component is present on the jobs/careers domains of the impacted sites.</span></span></div>
<div style="background-color: white; color: #333333; font-family: Verdana, Arial, Helvetica, sans-serif; font-size: 12px; line-height: 20px;">
<span style="font-size: small;"><span style="font-family: 'trebuchet ms', geneva;"><br /></span></span></div>
<div style="background-color: white; color: #333333; font-family: Verdana, Arial, Helvetica, sans-serif; font-size: 12px; line-height: 20px;">
<span style="font-size: small;"><span style="font-family: 'trebuchet ms', geneva;">The vulnerability was addressed roughly three months after it was reported to SAP. The company <a href="http://scn.sap.com/docs/DOC-55451" style="color: #0076b4; font-weight: bold; text-decoration: none;" target="_blank">acknowledged</a> the security researcher’s work in July.</span></span></div>
<div style="background-color: white; color: #333333; font-family: Verdana, Arial, Helvetica, sans-serif; font-size: 12px; line-height: 20px;">
<span style="font-size: small;"><span style="font-family: 'trebuchet ms', geneva;">Javed says he has also identified a series of flaws in SAP Enterprise Portal, which he plans on disclosing after they are resolved by the vendor.</span></span></div>
<div style="background-color: white; color: #333333; font-family: Verdana, Arial, Helvetica, sans-serif; font-size: 12px; line-height: 20px;">
<span style="font-size: small;"><span style="font-family: 'trebuchet ms', geneva;">Last month, the researcher reported finding an XSS vulnerability in YouTube Gaming, a gaming-focused video website launched this summer by YouTube. The expert reported his findings to Google and was awarded more than $3,000 for his work.</span></span></div>
</div>
<br>
<script async src="//pagead2.googlesyndication.com/pagead/js/adsbygoogle.js"></script>

<ins class="adsbygoogle"
     style="display:block"
     data-ad-client="ca-pub-7726750987177406"
     data-ad-slot="7596682374"
     data-ad-format="auto"></ins>
<script>
(adsbygoogle = window.adsbygoogle || []).push({});
</script>
<br>

Cyber Crime Hacker Hacking news Latest News Security news Flaw in SAP Firm's XSS Filter Exposed Many Sites to Attacks

Roughly one hundred websites were exposed to cross-site scripting (XSS) attacks because an XSS filter used on some of their web pages ...

New Types of Reflection DDoS Attacks Spotted

11:20 PM Unknown 0

DDoS Hacker Hacking news Latest News Security news New Types of Reflection DDoS Attacks Spotted

A new threat advisory published this week by Akamai’s Security Intelligence Response Team warns organizations about three new types...

Biggest Free Hosting Company Hacked - 13.5 Million Plaintext Passwords Leaked

10:20 PM Unknown 0

<div dir="ltr" style="text-align: left;" trbidi="on">
<div dir="ltr" style="text-align: left;" trbidi="on">
<div class="separator" style="clear: both; text-align: center;">
<a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEh-PPpXUGnMW8HfayFeJUAFLRkdCL5Hpr0v9aIyZZcKbHnHDmnpSQ6H2iq_8K4H3YU3A3gre8C98F1xz7-P-byeOX2ylevgyC_LA6l_FSvlDpNJwK4hnaFSK9KDWU1kK_mAQySFGgPh-_w/s1600/Biggest-Free-Hosting-Company-Hacked%253B-13.5-Million-Plaintext-Passwords-Leaked.gif" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" height="382" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEh-PPpXUGnMW8HfayFeJUAFLRkdCL5Hpr0v9aIyZZcKbHnHDmnpSQ6H2iq_8K4H3YU3A3gre8C98F1xz7-P-byeOX2ylevgyC_LA6l_FSvlDpNJwK4hnaFSK9KDWU1kK_mAQySFGgPh-_w/s640/Biggest-Free-Hosting-Company-Hacked%253B-13.5-Million-Plaintext-Passwords-Leaked.gif" width="640" /></a></div>
<br />
<br />
<div style="background-color: white; border: 0px; font-family: 'PT Sans', arial, sans-serif; font-size: 17px; font-stretch: inherit; line-height: 30px; margin: 0px; outline: 0px; padding: 0px; text-align: justify; vertical-align: baseline;">
The world’s most popular Free Web Hosting company <b style="border: 0px; font-family: inherit; font-size: inherit; font-stretch: inherit; font-style: inherit; font-variant: inherit; line-height: inherit; margin: 0px; outline: 0px; padding: 0px; vertical-align: baseline;"><u style="border: 0px; font-family: inherit; font-size: inherit; font-stretch: inherit; font-style: inherit; font-variant: inherit; font-weight: inherit; line-height: inherit; margin: 0px; outline: 0px; padding: 0px; vertical-align: baseline;">000Webhost</u></b> has suffered a major data breach, exposing more than 13.5 Million of its customers' personal records.</div>
<div style="background-color: white; border: 0px; font-family: 'PT Sans', arial, sans-serif; font-size: 17px; font-stretch: inherit; line-height: 30px; margin: 0px; outline: 0px; padding: 0px; text-align: justify; vertical-align: baseline;">
<br style="content: " "; display: block; margin: 20px 0px 0px; outline: 0px; padding: 0px;" /></div>
<div style="background-color: white; border: 0px; font-family: 'PT Sans', arial, sans-serif; font-size: 17px; font-stretch: inherit; line-height: 30px; margin: 0px; outline: 0px; padding: 0px; text-align: justify; vertical-align: baseline;">
The stolen data includes usernames, passwords in plain text, email addresses, IP addresses and last names of around 13.5 Million of 000Webhost's customers.</div>
<div style="background-color: white; border: 0px; font-family: 'PT Sans', arial, sans-serif; font-size: 17px; font-stretch: inherit; line-height: 30px; margin: 0px; outline: 0px; padding: 0px; text-align: justify; vertical-align: baseline;">
<br style="content: " "; display: block; margin: 20px 0px 0px; outline: 0px; padding: 0px;" /></div>
<div style="background-color: white; border: 0px; font-family: 'PT Sans', arial, sans-serif; font-size: 17px; font-stretch: inherit; line-height: 30px; margin: 0px; outline: 0px; padding: 0px; text-align: justify; vertical-align: baseline;">
According to a recent report published by <a href="http://www.forbes.com/sites/thomasbrewster/2015/10/28/000webhost-database-leak/" style="border: 0px; color: #3d5a99; font-family: inherit; font-size: inherit; font-stretch: inherit; font-style: inherit; font-variant: inherit; font-weight: bold; line-height: inherit; margin: 0px; outline: none; padding: 0px; text-decoration: none; vertical-align: baseline;" target="_blank">Forbes</a>, the Free Hosting service provider 000Webhost was hacked in March 2015 by an anonymous hacker.</div>
<div style="background-color: white; border: 0px; font-family: 'PT Sans', arial, sans-serif; font-size: 17px; font-stretch: inherit; line-height: 30px; margin: 0px; outline: 0px; padding: 0px; text-align: justify; vertical-align: baseline;">
<br /></div>
<div style="background-color: white; border: 0px; font-family: 'PT Sans', arial, sans-serif; font-size: 17px; font-stretch: inherit; line-height: 30px; margin: 0px; outline: 0px; padding: 0px; text-align: justify; vertical-align: baseline;">
<div style="border: 0px; font-stretch: inherit; margin: 0px; outline: 0px; padding: 0px; vertical-align: baseline;">
In a <a href="https://www.facebook.com/000webhost.Global/posts/998261600194776" rel="nofollow" style="border: 0px; color: #3d5a99; font-family: inherit; font-size: inherit; font-stretch: inherit; font-style: inherit; font-variant: inherit; font-weight: bold; line-height: inherit; margin: 0px; outline: none; padding: 0px; text-decoration: none; vertical-align: baseline;" target="_blank">post</a> on its official Facebook page, the hosting company has acknowledged the data breach and posted the following statement:</div>
<blockquote class="tr_bq" style="background-color: #f9f9f9; border-left-color: rgb(191, 202, 218); border-left-style: solid; border-width: 0px 0px 0px 8px; font-stretch: inherit; margin: 10px; outline: 0px; padding: 10px; quotes: none; vertical-align: baseline;">
<i style="border: 0px; font-family: inherit; font-size: inherit; font-stretch: inherit; font-variant: inherit; font-weight: inherit; line-height: inherit; margin: 0px; outline: 0px; padding: 0px; vertical-align: baseline;">"We have witnessed a database breach on our main server. A hacker used an exploit in old PHP version to upload some files, gaining access to our systems. Although <b style="border: 0px; font-family: inherit; font-size: inherit; font-stretch: inherit; font-style: inherit; font-variant: inherit; line-height: inherit; margin: 0px; outline: 0px; padding: 0px; vertical-align: baseline;"><u style="border: 0px; font-family: inherit; font-size: inherit; font-stretch: inherit; font-style: inherit; font-variant: inherit; font-weight: inherit; line-height: inherit; margin: 0px; outline: 0px; padding: 0px; vertical-align: baseline;">the whole database has been compromised</u></b>, we are mostly concerned about the leaked client information."</i></blockquote>
<div style="border: 0px; font-stretch: inherit; margin: 0px; outline: 0px; padding: 0px; vertical-align: baseline;">
The stolen data was obtained by <i style="border: 0px; font-family: inherit; font-size: inherit; font-stretch: inherit; font-variant: inherit; font-weight: inherit; line-height: inherit; margin: 0px; outline: 0px; padding: 0px; vertical-align: baseline;">Troy Hunt</i>, an Australian security researcher, who received the data from an anonymous source and also confirmed the authenticity of the data.</div>
<blockquote class="tr_bq" style="background-color: #f9f9f9; border-left-color: rgb(191, 202, 218); border-left-style: solid; border-width: 0px 0px 0px 8px; font-stretch: inherit; margin: 10px; outline: 0px; padding: 10px; quotes: none; vertical-align: baseline;">
<i style="border: 0px; font-family: inherit; font-size: inherit; font-stretch: inherit; font-variant: inherit; font-weight: inherit; line-height: inherit; margin: 0px; outline: 0px; padding: 0px; vertical-align: baseline;">"By now there's no remaining doubt that the breach is legitimate and that impacted users will have to know," </i>Hunt wrote in a <a href="http://www.troyhunt.com/2015/10/breaches-traders-plain-text-passwords.html" rel="nofollow" style="border: 0px; color: #3d5a99; font-family: inherit; font-size: inherit; font-stretch: inherit; font-style: inherit; font-variant: inherit; font-weight: bold; line-height: inherit; margin: 0px; outline: none; padding: 0px; text-decoration: none; vertical-align: baseline;" target="_blank">blog post</a> published Wednesday. <i style="border: 0px; font-family: inherit; font-size: inherit; font-stretch: inherit; font-variant: inherit; font-weight: inherit; line-height: inherit; margin: 0px; outline: 0px; padding: 0px; vertical-align: baseline;">"I'd prefer that 000webhost be the ones to notify [its customer] though."</i></blockquote>
<div style="border: 0px; font-stretch: inherit; margin: 0px; outline: 0px; padding: 0px; vertical-align: baseline;">
<br style="content: " "; display: block; margin: 20px 0px 0px; outline: 0px; padding: 0px;" /></div>
<h3 style="border: 0px; font-size: 1.4em; font-stretch: inherit; margin: 0px; outline: 0px; padding: 0px; vertical-align: baseline;">
000Webhost Ignored Data Breach Warnings Continuously</h3>
<div style="border: 0px; font-stretch: inherit; margin: 0px; outline: 0px; padding: 0px; vertical-align: baseline;">
<br style="content: " "; display: block; margin: 20px 0px 0px; outline: 0px; padding: 0px;" /></div>
<div style="border: 0px; font-stretch: inherit; margin: 0px; outline: 0px; padding: 0px; vertical-align: baseline;">
000Webhost web Hosting company repeatedly failed to pay attention to the early warnings by Troy Hunt and the Forbes journalist, but the company ultimately decided to ignore them.</div>
<div style="border: 0px; font-stretch: inherit; margin: 0px; outline: 0px; padding: 0px; vertical-align: baseline;">
<br style="content: " "; display: block; margin: 20px 0px 0px; outline: 0px; padding: 0px;" /></div>
<div style="border: 0px; font-stretch: inherit; margin: 0px; outline: 0px; padding: 0px; vertical-align: baseline;">
<b style="border: 0px; font-family: inherit; font-size: inherit; font-stretch: inherit; font-style: inherit; font-variant: inherit; line-height: inherit; margin: 0px; outline: 0px; padding: 0px; vertical-align: baseline;">What's even Worse?</b></div>
<div style="border: 0px; font-stretch: inherit; margin: 0px; outline: 0px; padding: 0px; vertical-align: baseline;">
<br style="content: " "; display: block; margin: 20px 0px 0px; outline: 0px; padding: 0px;" /></div>
<div style="border: 0px; font-stretch: inherit; margin: 0px; outline: 0px; padding: 0px; vertical-align: baseline;">
The Web Hosting company did not even follow fundamental and standard security practices to ensure the security of its customers.</div>
<div style="border: 0px; font-stretch: inherit; margin: 0px; outline: 0px; padding: 0px; vertical-align: baseline;">
<br style="content: " "; display: block; margin: 20px 0px 0px; outline: 0px; padding: 0px;" /></div>
<div style="border: 0px; font-stretch: inherit; margin: 0px; outline: 0px; padding: 0px; vertical-align: baseline;">
Data breaches are common these days. Just a few days back, we reported about a serious <a href="http://www.hackntech.net/2015/10/talktalk-downplays-data-breach.html" rel="nofollow" style="border: 0px; color: #3d5a99; font-family: inherit; font-size: inherit; font-stretch: inherit; font-style: inherit; font-variant: inherit; font-weight: bold; line-height: inherit; margin: 0px; outline: none; padding: 0px; text-decoration: none; vertical-align: baseline;" target="_blank">data breach at TalkTalk</a> – the biggest phone and broadband provider in the UK that put the personal data of its <b style="border: 0px; font-family: inherit; font-size: inherit; font-stretch: inherit; font-style: inherit; font-variant: inherit; line-height: inherit; margin: 0px; outline: 0px; padding: 0px; vertical-align: baseline;">4 Million customers at risk</b>.</div>
<div style="border: 0px; font-stretch: inherit; margin: 0px; outline: 0px; padding: 0px; vertical-align: baseline;">
<br style="content: " "; display: block; margin: 20px 0px 0px; outline: 0px; padding: 0px;" /></div>
<div style="border: 0px; font-stretch: inherit; margin: 0px; outline: 0px; padding: 0px; vertical-align: baseline;">
But, <i style="border: 0px; font-family: inherit; font-size: inherit; font-stretch: inherit; font-variant: inherit; font-weight: inherit; line-height: inherit; margin: 0px; outline: 0px; padding: 0px; vertical-align: baseline;">What could a Security Breach lead to?</i></div>
<div style="border: 0px; font-stretch: inherit; margin: 0px; outline: 0px; padding: 0px; vertical-align: baseline;">
</div>
<ul style="border: 0px; font-stretch: inherit; margin: 20px 20px 20px 35px; outline: 0px; padding: 0px 0px 0px 5px; vertical-align: baseline;">
<li style="border: 0px; font-family: inherit; font-size: inherit; font-stretch: inherit; font-style: inherit; font-variant: inherit; font-weight: inherit; line-height: inherit; margin: 0px; outline: 0px; padding: 0px; vertical-align: baseline;">Severe damage to company's reputation</li>
<li style="border: 0px; font-family: inherit; font-size: inherit; font-stretch: inherit; font-style: inherit; font-variant: inherit; font-weight: inherit; line-height: inherit; margin: 0px; outline: 0px; padding: 0px; vertical-align: baseline;">Loss of consumer trust</li>
<li style="border: 0px; font-family: inherit; font-size: inherit; font-stretch: inherit; font-style: inherit; font-variant: inherit; font-weight: inherit; line-height: inherit; margin: 0px; outline: 0px; padding: 0px; vertical-align: baseline;">Thousands of dollars in penalties and fines</li>
<li style="border: 0px; font-family: inherit; font-size: inherit; font-stretch: inherit; font-style: inherit; font-variant: inherit; font-weight: inherit; line-height: inherit; margin: 0px; outline: 0px; padding: 0px; vertical-align: baseline;">Personal data loss cost infinite</li>
<li style="border: 0px; font-family: inherit; font-size: inherit; font-stretch: inherit; font-style: inherit; font-variant: inherit; font-weight: inherit; line-height: inherit; margin: 0px; outline: 0px; padding: 0px; vertical-align: baseline;">Temporary or Permanent Closure</li>
</ul>
<div style="border: 0px; font-stretch: inherit; margin: 0px; outline: 0px; padding: 0px; vertical-align: baseline;">
<b style="border: 0px; font-family: inherit; font-size: inherit; font-stretch: inherit; font-style: italic; font-variant: inherit; line-height: inherit; margin: 0px; outline: 0px; padding: 0px; vertical-align: baseline;">Note:</b> At the time of writing, <u style="border: 0px; font-family: inherit; font-size: inherit; font-stretch: inherit; font-style: inherit; font-variant: inherit; font-weight: inherit; line-height: inherit; margin: 0px; outline: 0px; padding: 0px; vertical-align: baseline;">000webhost.com</u> website is temporarily down.</div>
<h3 style="border: 0px; font-size: 1.4em; font-stretch: inherit; margin: 0px; outline: 0px; padding: 0px; vertical-align: baseline;">
What Should You Do Now?</h3>
<div style="border: 0px; font-stretch: inherit; margin: 0px; outline: 0px; padding: 0px; vertical-align: baseline;">
<br style="content: " "; display: block; margin: 20px 0px 0px; outline: 0px; padding: 0px;" /></div>
<div style="border: 0px; font-stretch: inherit; margin: 0px; outline: 0px; padding: 0px; vertical-align: baseline;">
For security reasons, the team at Free Hosting service has changed all customers' passwords to the random values and implemented encryption, <i style="border: 0px; font-family: inherit; font-size: inherit; font-stretch: inherit; font-variant: inherit; font-weight: inherit; line-height: inherit; margin: 0px; outline: 0px; padding: 0px; vertical-align: baseline;">without giving any direct notice to its affected customers</i>.</div>
<div style="border: 0px; font-stretch: inherit; margin: 0px; outline: 0px; padding: 0px; vertical-align: baseline;">
<br style="content: " "; display: block; margin: 20px 0px 0px; outline: 0px; padding: 0px;" /></div>
<div style="border: 0px; font-stretch: inherit; margin: 0px; outline: 0px; padding: 0px; vertical-align: baseline;">
That means, if you are one of those 13.5 Million 000webhost clients, then you need to follow the <a href="http://members.000webhost.com/forgot_password.php" rel="nofollow" style="border: 0px; color: #3d5a99; font-family: inherit; font-size: inherit; font-stretch: inherit; font-style: inherit; font-variant: inherit; font-weight: bold; line-height: inherit; margin: 0px; outline: none; padding: 0px; text-decoration: none; vertical-align: baseline;" target="_blank">password reset process</a> to generate a new password in order to access your account.</div>
<div style="border: 0px; font-stretch: inherit; margin: 0px; outline: 0px; padding: 0px; vertical-align: baseline;">
<br style="content: " "; display: block; margin: 20px 0px 0px; outline: 0px; padding: 0px;" /></div>
<div style="border: 0px; font-stretch: inherit; margin: 0px; outline: 0px; padding: 0px; vertical-align: baseline;">
However, 000Webhost said: <i style="border: 0px; font-family: inherit; font-size: inherit; font-stretch: inherit; font-variant: inherit; font-weight: inherit; line-height: inherit; margin: 0px; outline: 0px; padding: 0px; vertical-align: baseline;">"We removed all illegally uploaded pages as soon as we became aware of the [data] breach. Next, we changed all the passwords and increased their encryption to avoid such mishaps in the future."</i></div>
<div style="border: 0px; font-stretch: inherit; margin: 0px; outline: 0px; padding: 0px; vertical-align: baseline;">
<br style="content: " "; display: block; margin: 20px 0px 0px; outline: 0px; padding: 0px;" /></div>
<div style="border: 0px; font-stretch: inherit; margin: 0px; outline: 0px; padding: 0px; vertical-align: baseline;">
Storing customers passwords in plain text, ignoring early warnings, and then implementing encryption to prevent further damages.</div>
</div>
</div>
<br />
<script async="" src="//pagead2.googlesyndication.com/pagead/js/adsbygoogle.js"></script>

<br />
<ins class="adsbygoogle" data-ad-client="ca-pub-7726750987177406" data-ad-format="auto" data-ad-slot="7596682374" style="display: block;"></ins><script>
(adsbygoogle = window.adsbygoogle || []).push({});
</script>
</div>

Facebook Hacker Hacking news Latest News Security news Biggest Free Hosting Company Hacked - 13.5 Million Plaintext Passwords Leaked

The world’s most popular Free Web Hosting company 000Webhost has suffered a major data breach, exposing more than 13.5 Million of i...

Teen Arrested in Connection With TalkTalk Breach

3:28 AM Unknown 0

Cyber Crime Google Hacker Hacking news Latest News Security news Teen Arrested in Connection With TalkTalk Breach

A 15-year-old boy from Northern Ireland was arrested on Monday in connection to the recent cyberattack on British phone and broadband...

TalkTalk Downplays Data Breach

10:37 PM Unknown 0

Hacker Hacking news Latest News Security news TalkTalk Downplays Data Breach

The recent data breach has not affected core systems and the exposed financial data cannot be used to steal money from customer acco...

Teen Hacker Says He Cracked CIA Head's Personal Email: Media

10:31 PM Unknown 0

<div dir="ltr" style="text-align: left;" trbidi="on">
<div class="separator" style="clear: both; text-align: center;">
<a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhdGXDMWKu8IT10861cX-iFTN3B7wS5WJwj5enjOFpLdoFnaCFlshXAaOtkBgqM_BrKAZQ9vkYYIKLXP3kIsrLv9Nv23fNGZPV1wGhrEVcSmCRQ1a4YcGsAbU1wyGfZ0fJ73NDaIuoPUbw/s1600/Teen-Hacker.gif" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" height="354" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhdGXDMWKu8IT10861cX-iFTN3B7wS5WJwj5enjOFpLdoFnaCFlshXAaOtkBgqM_BrKAZQ9vkYYIKLXP3kIsrLv9Nv23fNGZPV1wGhrEVcSmCRQ1a4YcGsAbU1wyGfZ0fJ73NDaIuoPUbw/s640/Teen-Hacker.gif" width="640" /></a></div>
<br />
<br />
<div style="background-color: white; color: #333333; font-family: Verdana, Arial, Helvetica, sans-serif; font-size: 12px; line-height: 20px;">
<span style="font-size: small;"><span style="font-family: 'trebuchet ms', geneva;"><strong>A teenaged hacker broke into CIA Director John Brennan's personal email account and swiped sensitive files including a top-secret application for a security clearance, the New York Post reported.</strong></span></span></div>
<div style="background-color: white; color: #333333; font-family: Verdana, Arial, Helvetica, sans-serif; font-size: 12px; line-height: 20px;">
<span style="font-size: small;"><span style="font-family: 'trebuchet ms', geneva;"><strong><br /></strong></span></span></div>
<div style="background-color: white; color: #333333; font-family: Verdana, Arial, Helvetica, sans-serif; font-size: 12px; line-height: 20px;">
<span style="font-size: small;"><span style="font-family: 'trebuchet ms', geneva;">If true, the story will be a major embarrassment for Brennan and the Central Intelligence Agency, coming after months of intense national scrutiny of Hillary Clinton for her use of a private email server when she was secretary of state.</span></span></div>
<div style="background-color: white; color: #333333; font-family: Verdana, Arial, Helvetica, sans-serif; font-size: 12px; line-height: 20px;">
<span style="font-size: small;"><span style="font-family: 'trebuchet ms', geneva;">The Post said a hacker, describing himself as an American high school student, had called the newspaper to describe his exploits.</span></span></div>
<div style="background-color: white; color: #333333; font-family: Verdana, Arial, Helvetica, sans-serif; font-size: 12px; line-height: 20px;">
<span style="font-size: small;"><span style="font-family: 'trebuchet ms', geneva;">Stored on Brennan's private email account were a range of sensitive files including his 47-page application for the security clearance, the hacker told The Post in a story Sunday.</span></span></div>
<div style="background-color: white; color: #333333; font-family: Verdana, Arial, Helvetica, sans-serif; font-size: 12px; line-height: 20px;">
<span style="font-size: small;"><span style="font-family: 'trebuchet ms', geneva;">In a series of tweets from his purported Twitter account -- <strong>@phphax</strong> -- the hacker taunted authorities and showed redacted images of what appeared to be sensitive government information.</span></span></div>
<div style="background-color: white; color: #333333; font-family: Verdana, Arial, Helvetica, sans-serif; font-size: 12px; line-height: 20px;">
<span style="font-size: small;"><span style="font-family: 'trebuchet ms', geneva;"><br /></span></span></div>
<div style="background-color: white; color: #333333; font-family: Verdana, Arial, Helvetica, sans-serif; font-size: 12px; line-height: 20px;">
<span style="font-size: small;"><span style="font-family: 'trebuchet ms', geneva;">The account references "CWA." The hacker told the Post this stood for "Crackas With Attitude," which he said referred to him and a classmate.</span></span></div>
<div style="background-color: white; color: #333333; font-family: Verdana, Arial, Helvetica, sans-serif; font-size: 12px; line-height: 20px;">
<span style="font-size: small;"><span style="font-family: 'trebuchet ms', geneva;">The man said he was not Muslim but carried out the hack because he opposed US foreign policy and supported Palestine.</span></span></div>
<div style="background-color: white; color: #333333; font-family: Verdana, Arial, Helvetica, sans-serif; font-size: 12px; line-height: 20px;">
<span style="font-size: small;"><span style="font-family: 'trebuchet ms', geneva;">As well as cracking Brennan's personal AOL account, he claimed to have targeted Department of Homeland Security Secretary Jeh Johnson, accessing his Internet provider account and listening to his voicemails.</span></span></div>
<div style="background-color: white; color: #333333; font-family: Verdana, Arial, Helvetica, sans-serif; font-size: 12px; line-height: 20px;">
<span style="font-size: small;"><span style="font-family: 'trebuchet ms', geneva;"><br /></span></span></div>
<div style="background-color: white; color: #333333; font-family: Verdana, Arial, Helvetica, sans-serif; font-size: 12px; line-height: 20px;">
<span style="font-size: small;"><span style="font-family: 'trebuchet ms', geneva;">The CIA did not immediately respond to a request for comment Monday but told the Post it had "referred the matter to the appropriate authorities."</span></span></div>
<div style="background-color: white; color: #333333; font-family: Verdana, Arial, Helvetica, sans-serif; font-size: 12px; line-height: 20px;">
<span style="font-size: small;"><span style="font-family: 'trebuchet ms', geneva;">A Homeland Security spokesman told AFP: "We are aware of the media report, however as a matter of policy, we do not comment on the Secretary's personal security."</span></span></div>
<div style="background-color: white; color: #333333; font-family: Verdana, Arial, Helvetica, sans-serif; font-size: 12px; line-height: 20px;">
<span style="font-size: small;"><span style="font-family: 'trebuchet ms', geneva;">According to CNN, the FBI and Secret Service are investigating the report.</span></span></div>
<div style="background-color: white; color: #333333; font-family: Verdana, Arial, Helvetica, sans-serif; font-size: 12px; line-height: 20px;">
<span style="font-size: small;"><span style="font-family: 'trebuchet ms', geneva;">The Post said the alleged hacker told them he accessed the account by using a process called "social engineering" in which he tricked Verizon workers into divulging Brennan's personal information then convinced AOL to reset his password.</span></span></div>
<div style="background-color: white; color: #333333; font-family: Verdana, Arial, Helvetica, sans-serif; font-size: 12px; line-height: 20px;">
<span style="font-size: small;"><span style="font-family: 'trebuchet ms', geneva;">The hacker told the newspaper he had even prank-called America's top spy and taunted him by reciting Brennan's Social Security number.</span></span></div>
<div style="background-color: white; color: #333333; font-family: Verdana, Arial, Helvetica, sans-serif; font-size: 12px; line-height: 20px;">
<span style="font-size: small;"><span style="font-family: 'trebuchet ms', geneva;"><br /></span></span></div>
<div style="background-color: white; color: #333333; font-family: Verdana, Arial, Helvetica, sans-serif; font-size: 12px; line-height: 20px;">
<span style="font-size: small;"><span style="font-family: 'trebuchet ms', geneva;">"He waited a tiny bit and hung up," the hacker told the Post.</span></span></div>
<div style="background-color: white; color: #333333; font-family: Verdana, Arial, Helvetica, sans-serif; font-size: 12px; line-height: 20px;">
<span style="font-size: small;"><span style="font-family: 'trebuchet ms', geneva;">The government is still reeling after hackers this summer breached US government databases and stole personal information from background checks of 21.5 million people.</span></span></div>
</div>
<br>
<script async src="//pagead2.googlesyndication.com/pagead/js/adsbygoogle.js"></script>

<ins class="adsbygoogle"
     style="display:block"
     data-ad-client="ca-pub-7726750987177406"
     data-ad-slot="7596682374"
     data-ad-format="auto"></ins>
<script>
(adsbygoogle = window.adsbygoogle || []).push({});
</script>
<br>

Cyber Crime Hacker Hacking news Latest News Security news Teen Hacker Says He Cracked CIA Head's Personal Email: Media

A teenaged hacker broke into CIA Director John Brennan's personal email account and swiped sensitive files including a top-secret ...

Latest Hacking News And Events - dA1337