Latest Hacking News And Events - dA1337: Hacking news

Pro PoS — This Stealthy Point-of-Sale Malware Could Steal Your Christmas

<div dir="ltr" style="text-align: left;" trbidi="on">
<div class="separator" style="clear: both; text-align: center;">
<a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhcpygoi9H99N_mKBKOJItbOoizLuMeLZfZqvz187z4gPDH8c0QAT8FfCGecU9oUjfggJr9kOdxUDV2s-Wz01-gh7B4-7uq1iA50pZgB2D8NZKZfStCTkMSxTZgk2NxRcPniAWvwMO8OQg/s1600/credit-card-security.jpg" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" height="333" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhcpygoi9H99N_mKBKOJItbOoizLuMeLZfZqvz187z4gPDH8c0QAT8FfCGecU9oUjfggJr9kOdxUDV2s-Wz01-gh7B4-7uq1iA50pZgB2D8NZKZfStCTkMSxTZgk2NxRcPniAWvwMO8OQg/s640/credit-card-security.jpg" width="640" /></a></div>
<div style="text-align: justify;">
</div>
<div style="text-align: justify;">
<span style="font-family: "georgia" , "times new roman" , serif;">The 
point of Sale systems are the most tempting target for cyber crooks to 
steal your credit card information and with this Christmas, you need to 
be more careful while using your credit cards at retailers and grocery 
stores.</span></div>
<span style="font-family: "georgia" , "times new roman" , serif;">
</span>
<br />
<script async="" src="//pagead2.googlesyndication.com/pagead/js/adsbygoogle.js"></script>

<br />
<ins class="adsbygoogle" data-ad-client="ca-pub-7726750987177406" data-ad-format="auto" data-ad-slot="7596682374" style="display: block;"></ins><script>
(adsbygoogle = window.adsbygoogle || []).push({});
</script>

<div style="text-align: justify;">
<span style="font-family: "georgia" , "times new roman" , serif;"><b>Here's why… </b></span></div>
<span style="font-family: "georgia" , "times new roman" , serif;">
</span>
<div style="text-align: justify;">
<span style="font-family: "georgia" , "times new roman" , serif;">
Cyber criminals are now selling a new powerful strain of Point of Sale (PoS) malware through underground forums.</span></div>
<span style="font-family: "georgia" , "times new roman" , serif;">
</span>
<br />
<div style="text-align: justify;">
<span style="font-family: "georgia" , "times new roman" , serif;">
Like several POS malware families discovered last year, including vSkimmer and BlackPOS, the new malware is also designed to steal payment card data from the infected POS systems and <b>support TOR </b>to hide its C&C (Command and Control) servers.</span></div>
<div style="text-align: justify;">
</div>
<div style="text-align: justify;">
<span style="font-family: "georgia" , "times new roman" , serif;"><span class="main-article-info"></span></span><br />
<h3 style="text-align: justify;">
<span style="font-family: "georgia" , "times new roman" , serif;"><span class="main-article-info">
Pro PoS – Light Weight, Yet Powerful Malware</span></span></h3>
<span style="font-family: "georgia" , "times new roman" , serif;"><span class="main-article-info">
</span></span>
<br />
<div style="text-align: justify;">
<script async="" src="//pagead2.googlesyndication.com/pagead/js/adsbygoogle.js"></script>

<br />
<ins class="adsbygoogle" data-ad-client="ca-pub-7726750987177406" data-ad-format="auto" data-ad-slot="7596682374" style="display: block;"></ins><script>
(adsbygoogle = window.adsbygoogle || []).push({});
</script>
</div>
<span style="font-family: "georgia" , "times new roman" , serif;"><span class="main-article-info">
</span></span>
<br />
<div style="text-align: justify;">
<span style="font-family: "georgia" , "times new roman" , serif;"><span class="main-article-info">However, the new malware, dubbed "<b>Pro PoS</b>," packs more than just a PoS malware.</span></span></div>
<span style="font-family: "georgia" , "times new roman" , serif;"><span class="main-article-info">
</span></span>
<div style="text-align: justify;">
</div>
<span style="font-family: "georgia" , "times new roman" , serif;"><span class="main-article-info">
<div style="text-align: justify;">
Pro PoS weighs only 76KB, implements rootkit functionalities, as well as
 mechanisms to avoid antivirus detection, according to threat 
intelligence firm InfoArmor.</div>
<div style="text-align: justify;">
</div>
<div style="text-align: justify;">
What's even more interesting about this malware is…</div>
<div style="text-align: justify;">
</div>
<div style="text-align: justify;">
Pro PoS integrates a <b>polymorphic engine </b>that lets the threat generate a different signature for each malware sample – a measure designed to foil security defences.</div>
<div style="text-align: justify;">
</div>
<div style="text-align: justify;">
InfoArmor warned that cyber crooks were actively using the current version of <b>Pro PoS Solution</b> in an effort to target PoS systems used by large retailers and SMBs in the United States and Canada specifically.</div>
<div style="text-align: justify;">
</div>
<h3 style="text-align: justify;">
Pro PoS Malware found in the Wild</h3>
<div style="text-align: justify;">
</div>
<div style="text-align: justify;">
The developers of the Pro PoS malware are believed to be hackers from Eastern Europe, according to the security firm.</div>
<div style="text-align: justify;">
</div>
<div style="text-align: justify;">
On November 27 (<b>Black Friday</b>), researchers at InfoArmor noticed a significant increase in the price of the Pro PoS Solution, which was offered at <b>$2,600 </b>for a six-month licence.</div>
<div style="text-align: justify;">
</div>
<div style="text-align: justify;">
The developers of Pro PoS have designed their malware in such a way that
 it infects the principal operating systems, including newer operating 
systems, used by the companies in the retail environment.</div>
</span></span><span style="font-family: "georgia" , "times new roman" , serif;"> </span></div>
</div>

Hacker Hacking news Latest News Security news Pro PoS — This Stealthy Point-of-Sale Malware Could Steal Your Christmas

The point of Sale systems are the most tempting target for cyber crooks to steal your credit card information and with this Christma...

Critical 'Port Fail' Vulnerability Reveals Real IP Addresses of VPN Users

9:20 PM Unknown 0

<div dir="ltr" style="text-align: left;" trbidi="on">
<div class="separator" style="clear: both; text-align: center;">
<a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjysD8aD63_udawCkQwXO0jmzMJ32kKgA4V6Oz14-WSXQ0x0zAp4KCkavwbj1DHU5Zk-kVNaf5f2YfZk5yC3g4AuwFSPo_rcuyE2e6avv3d2_6zW4yyvJHVSo-oJ2149J6PgEsE7aa7DUg/s1600/vpn-hacking.png" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" height="334" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjysD8aD63_udawCkQwXO0jmzMJ32kKgA4V6Oz14-WSXQ0x0zAp4KCkavwbj1DHU5Zk-kVNaf5f2YfZk5yC3g4AuwFSPo_rcuyE2e6avv3d2_6zW4yyvJHVSo-oJ2149J6PgEsE7aa7DUg/s640/vpn-hacking.png" width="640" /></a></div>
<div style="text-align: justify;">
<span style="font-family: Georgia,"Times New Roman",serif;"> </span></div>
<div style="text-align: justify;">
<span style="font-family: Georgia,"Times New Roman",serif;">A 
newly discovered flaw affecting all VPN protocols and operating systems 
has the capability to reveal the real IP-addresses of users' computers, 
including BitTorrent users, with relative ease.</span></div>
<span style="font-family: Georgia,"Times New Roman",serif;">
</span><div style="text-align: justify;">
<span style="font-family: Georgia,"Times New Roman",serif;"><br /></span></div>
<span style="font-family: Georgia,"Times New Roman",serif;">
</span><div style="text-align: justify;">
<span style="font-family: Georgia,"Times New Roman",serif;">
The vulnerability, dubbed <b>Port Fail </b>by VPN provider Perfect 
Privacy (PP) who discovered the issue, is a simple port forwarding trick
 and affects those services that:</span></div>
<span style="font-family: Georgia,"Times New Roman",serif;">
</span><ul style="text-align: left;">
<li style="text-align: justify;"><span style="font-family: Georgia,"Times New Roman",serif;">Allow port forwarding</span></li>
<br />
<script async src="//pagead2.googlesyndication.com/pagead/js/adsbygoogle.js"></script>

<ins class="adsbygoogle"
     style="display:block"
     data-ad-client="ca-pub-7726750987177406"
     data-ad-slot="7596682374"
     data-ad-format="auto"></ins>
<script>
(adsbygoogle = window.adsbygoogle || []).push({});
</script>
<br />
<li style="text-align: justify;"><span style="font-family: Georgia,"Times New Roman",serif;">Have no protection against this specific attack</span></li>
</ul>
<span style="font-family: Georgia,"Times New Roman",serif;">
</span><div style="text-align: justify;">
<span style="font-family: Georgia,"Times New Roman",serif;">
Port Forwarding trick means if an attacker uses the same VPN (<b>Virtual Private Network</b>) as the victim, then the real IP-address of the victim can be exposed by forwarding Internet traffic to a specific port.</span></div>
<span style="font-family: Georgia,"Times New Roman",serif;">
</span><blockquote style="text-align: justify;">
<span style="font-family: Georgia,"Times New Roman",serif;"><i>"The crucial issue here is that a VPN user connecting to his own VPN 
server will use his default route with his real IP address, as this is 
required for the VPN connection to work," </i>Perfect Privacy wrote in a <a href="https://www.perfect-privacy.com/blog/2015/11/26/ip-leak-vulnerability-affecting-vpn-providers-with-port-forwarding/" rel="nofollow" target="_blank">blog post</a> on Thursday.</span></blockquote>
<span style="font-family: Georgia,"Times New Roman",serif;"><span class="main-article-info"></span></span><br />
<div style="text-align: justify;">
Port Fail affects all VPN protocols including…</div>
<ul style="text-align: left;">
<li style="text-align: justify;">OpenVPN</li>
<li style="text-align: justify;">IPSec</li>
</ul>
<div style="text-align: justify;">
…as well as applies to all operating systems, posing a huge privacy risk. </div>
<h3 style="text-align: justify;">
How Does 'Port Fail' Work?</h3>
<div style="text-align: justify;">
A successful IP address leak attack requires an attacker to be on the 
same VPN network as the victim and to know the victim's VPN exit IP 
address, which could be discovered by tricking a victim into visiting a 
website control controlled by the attacker.</div>
<div style="text-align: justify;">
</div>
<div style="text-align: justify;">
For example, an attacker with port forwarding enabled can see the 
request from the victim's actual IP addresses by tricking the victim 
into opening an image file. </div>
<div style="text-align: justify;">
</div>
<br />
<script async src="//pagead2.googlesyndication.com/pagead/js/adsbygoogle.js"></script>

<ins class="adsbygoogle"
     style="display:block"
     data-ad-client="ca-pub-7726750987177406"
     data-ad-slot="7596682374"
     data-ad-format="auto"></ins>
<script>
(adsbygoogle = window.adsbygoogle || []).push({});
</script>
<br />
<div style="text-align: justify;">
The same attack is possible for<b> BitTorrent users</b>, but, in this case, there is no need for the attacker to redirect the victim to their page. </div>
<div style="text-align: justify;">
</div>
<div style="text-align: justify;">
In this case, the attacker only with the activated port forwarding for 
the default BitTorrent port, can expose the real IP-address of a VPN 
user on the same network.</div>
<br />
<span style="font-family: Georgia,"Times New Roman",serif;"><span class="main-article-info"></span></span><br />
<h3 style="text-align: justify;">
Affected VPN Providers</h3>
<div style="text-align: justify;">
The flaw affected various large VPN providers. Perfect Privacy tested 
nine VPN providers out of which five were found to be vulnerable to this
 flaw and were alerted last week. </div>
<div style="text-align: justify;">
</div>
<div style="text-align: justify;">
VPN providers including Private Internet Access (PIA), Ovpn.to and nVPN have fixed the issue before publication.</div>
<div style="text-align: justify;">
</div>
<div style="text-align: justify;">
However, the company warned, <i>"other VPN providers may be vulnerable to this attack as we could not possibly test all."</i></div>
<div style="text-align: justify;">
</div>
<br />
<script async src="//pagead2.googlesyndication.com/pagead/js/adsbygoogle.js"></script>

<ins class="adsbygoogle"
     style="display:block"
     data-ad-client="ca-pub-7726750987177406"
     data-ad-slot="7596682374"
     data-ad-format="auto"></ins>
<script>
(adsbygoogle = window.adsbygoogle || []).push({});
</script>
<br />
<div style="text-align: justify;">
VPN aims to make you sure that your real identity remains anonymous on 
the Internet so that nobody could track the origin of your connection 
back to you, but this newly discovered flaw shows that it's quite easy 
to bypass this on some VPN providers.</div>
<span style="font-family: Georgia,"Times New Roman",serif;"> </span></div>

Hacker Hacking news Latest News Security news Vulnerabilities Critical 'Port Fail' Vulnerability Reveals Real IP Addresses of VPN Users

A newly discovered flaw affecting all VPN protocols and operating systems has the capability to reveal the real IP-addresses of us...

Millions of IoT Devices Using Same Hard-Coded CRYPTO Keys

9:01 PM Unknown 0

<div dir="ltr" style="text-align: left;" trbidi="on">
<div class="separator" style="clear: both; text-align: center;">
<a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEh9TDTs8upavk0DL-Vk6caK-rdSwDfMh0TGGwGjdcuOIMDax-eORTd_QPuK8xXdNUWuXpBcge0gIs3u2kh8yOvNaoXUvJRxY-g0SY5bTFK8zX2KRZVLAmNEyTq0fPO1FX4FJq4jk2oZppQ/s1600/CRYPTO-KEYS.png" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" height="333" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEh9TDTs8upavk0DL-Vk6caK-rdSwDfMh0TGGwGjdcuOIMDax-eORTd_QPuK8xXdNUWuXpBcge0gIs3u2kh8yOvNaoXUvJRxY-g0SY5bTFK8zX2KRZVLAmNEyTq0fPO1FX4FJq4jk2oZppQ/s640/CRYPTO-KEYS.png" width="640" /></a></div>
<div style="text-align: justify;">
<span style="font-family: Georgia,"Times New Roman",serif;"> </span></div>
<div style="text-align: justify;">
<span style="font-family: Georgia,"Times New Roman",serif;">Millions of embedded devices, including home routers, modems, IP cameras, VoIP phones, are shareing the same hard-coded <b>SSH</b> (Secure Shell) cryptographic keys or <b>HTTPS</b> (HTTP Secure) server certificates that expose them to various types of malicious attacks.</span></div>
<span style="font-family: Georgia,"Times New Roman",serif;">
</span><div style="text-align: justify;">
<span style="font-family: Georgia,"Times New Roman",serif;">
</BR>
<script async src="//pagead2.googlesyndication.com/pagead/js/adsbygoogle.js"></script>

<ins class="adsbygoogle"
     style="display:block"
     data-ad-client="ca-pub-7726750987177406"
     data-ad-slot="7596682374"
     data-ad-format="auto"></ins>
<script>
(adsbygoogle = window.adsbygoogle || []).push({});
</script><br /></span></div>
<span style="font-family: Georgia,"Times New Roman",serif;">
</span><div style="text-align: justify;">
<span style="font-family: Georgia,"Times New Roman",serif;">
A new analysis by IT security consultancy <i>SEC Consult </i>shows that 
the lazy manufacturers of the Internet of Things (IoTs) and Home Routers
 are reusing the same set of hard-coded cryptographic keys, leaving 
devices open to Hijacking.</span></div>
<span style="font-family: Georgia,"Times New Roman",serif;">
</span><div style="text-align: justify;">
<span style="font-family: Georgia,"Times New Roman",serif;"><br /></span></div>
<span style="font-family: Georgia,"Times New Roman",serif;">
</span><div style="text-align: justify;">
<span style="font-family: Georgia,"Times New Roman",serif;">
In simple words, this means that if you are able to access one device 
remotely, you can possibly log into hundreds of thousands of other 
devices – including the devices from different manufacturers.</span></div>
<div style="text-align: justify;">
<h3 style="text-align: justify;">
<span style="font-family: Georgia,"Times New Roman",serif;">
Re-Using Same Encryption Keys</span></h3>
<div style="text-align: justify;">
<span style="font-family: Georgia,"Times New Roman",serif;">
In its <a href="http://blog.sec-consult.com/2015/11/house-of-keys-industry-wide-https.html" rel="nofollow" target="_blank">survey of IoT devices</a>,
 the company studied 4,000 embedded devices from 70 different hardware 
vendors, ranging from simple home routers to Internet gateway servers, 
and discovered that…</span></div>
<div style="text-align: justify;">
<span style="font-family: Georgia,"Times New Roman",serif;">
</br>
<script async src="//pagead2.googlesyndication.com/pagead/js/adsbygoogle.js"></script>

<ins class="adsbygoogle"
     style="display:block"
     data-ad-client="ca-pub-7726750987177406"
     data-ad-slot="7596682374"
     data-ad-format="auto"></ins>
<script>
(adsbygoogle = window.adsbygoogle || []).push({});
</script><br /></span></div>
<div style="text-align: justify;">
<span style="font-family: Georgia,"Times New Roman",serif;">
…over 580 unique private cryptographic keys for SSH and HTTPS are 
re-shared between multiple devices from the same vendor and even from 
the different vendors.</span></div>
<div style="text-align: justify;">
<span style="font-family: Georgia,"Times New Roman",serif;"><br /></span></div>
<div style="text-align: justify;">
<span style="font-family: Georgia,"Times New Roman",serif;">
The most common use of these static keys are:</span></div>
<div style="text-align: justify;">
</div>
<ul>
<li><span style="font-family: Georgia,"Times New Roman",serif;"><b>SSH host keys</b></span></li>
<li><span style="font-family: Georgia,"Times New Roman",serif;"><b>X.509 HTTPS certificates</b></span></li>
</ul>
<div style="text-align: justify;">
<span style="font-family: Georgia,"Times New Roman",serif;">
SSH host keys verify the identity of a device that runs an SSH server 
using a public-private key pair. If an attacker steals the device's SSH 
host private key, he/she can impersonate the device and trick the 
victim's computer to talk to his computer instead.</span>
</div>
<span style="font-family: Georgia,"Times New Roman",serif;"> </span></div>
<div style="text-align: justify;">
<div style="text-align: justify;">
<span style="font-family: Georgia,"Times New Roman",serif;">
The same happens in the case of websites if an attacker gains access to 
the device's HTTPS private certificate, which is actually used to 
encrypt traffic between users and its Web-based management interface.</span></div>
<div style="text-align: justify;">
<span style="font-family: Georgia,"Times New Roman",serif;"><br /></span></div>
<div style="text-align: justify;">
<span style="font-family: Georgia,"Times New Roman",serif;">
The attacker can then decrypt the traffic to extract usernames, 
passwords and other sensitive data with the help of device's HTTPS 
private key.</span></div>
<h3 style="text-align: justify;">
<span style="font-family: Georgia,"Times New Roman",serif;">
MILLLLLIONS of Devices Open to Attacks</span></h3>
<div style="text-align: justify;">
<span style="font-family: Georgia,"Times New Roman",serif;">
When scanned the Internet for those 580 keys, the researchers found that
 at least 230 crypto keys are actively being used by more than 4 Million
 IoT devices.</span></div>
<br />
<script async src="//pagead2.googlesyndication.com/pagead/js/adsbygoogle.js"></script>

<ins class="adsbygoogle"
     style="display:block"
     data-ad-client="ca-pub-7726750987177406"
     data-ad-slot="7596682374"
     data-ad-format="auto"></ins>
<script>
(adsbygoogle = window.adsbygoogle || []).push({});
</script>
<br />
<div style="text-align: justify;">
<span style="font-family: Georgia,"Times New Roman",serif;"><br /></span></div>
<div style="text-align: justify;">
<span style="font-family: Georgia,"Times New Roman",serif;">
Moreover, the researchers recovered around 150 HTTPS server certificates
 that are used by 3.2 Million devices, along with 80 SSH host keys that 
are used by at least 900,000 devices.</span></div>
<div style="text-align: justify;">
<span style="font-family: Georgia,"Times New Roman",serif;"><br /></span>
</div>
<div style="text-align: justify;">
<div style="text-align: justify;">
<span style="font-family: Georgia,"Times New Roman",serif;">
The remaining crypto keys might be used by various other devices that 
are not connected to the Internet, but could still be vulnerable to <b>man-in-the-middle (MITM) attacks </b>within their respective local area networks.</span></div>
<div style="text-align: justify;">
<span style="font-family: Georgia,"Times New Roman",serif;"><br /></span></div>
<div style="text-align: justify;">
<span style="font-family: Georgia,"Times New Roman",serif;">
As a result, potentially Millions of Internet-connected devices can be 
logged into by attackers, or their HTTPS web server connections can 
silently be decrypted by MitM attackers, using these crypto keys and 
certs once they're extracted from their firmware.</span></div>
<div style="text-align: justify;">
<span style="font-family: Georgia,"Times New Roman",serif;"><br /></span></div>
<h3 style="text-align: justify;">
<span style="font-family: Georgia,"Times New Roman",serif;">
Where Does the actual Problem Reside?</span></h3>
<div style="text-align: justify;">
<span style="font-family: Georgia,"Times New Roman",serif;"><br /></span></div>
<div style="text-align: justify;">
<span style="font-family: Georgia,"Times New Roman",serif;">
The issue lies in the way vendors build and deploy their products. 
Typically, the vendors built their device's firmware based on <b>software development kits </b>(SDKs) received from chipmakers…</span></div>
<div style="text-align: justify;">
<span style="font-family: Georgia,"Times New Roman",serif;"><br /></span></div>
<div style="text-align: justify;">
<span style="font-family: Georgia,"Times New Roman",serif;">
…without even bothering to change the source code or even the keys or certificates that are already present in those SDKs.</span></div>
<div style="text-align: justify;">
<span style="font-family: Georgia,"Times New Roman",serif;"><br /></span></div>
<div style="text-align: justify;">
<span style="font-family: Georgia,"Times New Roman",serif;">
There are many reasons why this large number of devices are accessible from the Internet via HTTPS and SSH. These include:</span></div>
<div style="text-align: justify;">
</div>
<ul>
<li><span style="font-family: Georgia,"Times New Roman",serif;">Insecure default configurations by vendors</span></li>
<li><span style="font-family: Georgia,"Times New Roman",serif;">Automatic port forwarding via UPnP</span></li>
<li><span style="font-family: Georgia,"Times New Roman",serif;">Provisioning by ISPs that configure their subscribers' devices for remote management</span></li>
</ul>
<blockquote style="text-align: justify;">
<span style="font-family: Georgia,"Times New Roman",serif;"><i>"The source of the keys is an interesting aspect. Some keys are only 
found in one product or several products in the same product line. In 
other cases we found the same keys in products from various vendors,"</i> Sec Consult wrote in its <a href="http://blog.sec-consult.com/2015/11/house-of-keys-industry-wide-https.html" rel="nofollow" target="_blank">blog post</a>.</span></blockquote>
<h3 style="text-align: justify;">
<span style="font-family: Georgia,"Times New Roman",serif;">
List of Vendors that are Re-Using Encryption Keys</span></h3>
<div style="text-align: justify;">
<span style="font-family: Georgia,"Times New Roman",serif;">
Although SEC Consult identified more than 900 vulnerable products from 
roughly 50 manufacturers, the actual number could be even higher 
considering that its study only targeted firmware the company had access
 to.</span></div>
<div style="text-align: justify;">
<span style="font-family: Georgia,"Times New Roman",serif;"> </span></div>
<div style="text-align: justify;">
<span style="font-family: Georgia,"Times New Roman",serif;"><span class="main-article-info"><div style="text-align: justify;">
According to SEC Consult, these are the companies that were found reusing encryption keys:</div>
<blockquote style="text-align: justify;">
ADB, AMX, Actiontec, Adtran, Alcatel-Lucent, Alpha Networks, Aruba 
Networks, Aztech, Bewan, Busch-Jaeger, CTC Union, Cisco, Clear, 
Comtrend, D-Link, Deutsche Telekom, DrayTek, Edimax, General Electric 
(GE), Green Packet, Huawei, Infomark, Innatech, Linksys, Motorola, Moxa,
 NETGEAR, NetComm Wireless, ONT, Observa Telecom, Opengear, Pace, 
Philips, Pirelli , Robustel, Sagemcom, Seagate, Seowon Intech, Sierra 
Wireless, Smart RG, TP-LINK, TRENDnet, Technicolor, Tenda, Totolink, 
unify, UPVEL, Ubee Interactive, Ubiquiti Networks, Vodafone, Western 
Digital, ZTE, Zhone and ZyXEL.</blockquote>
<h3 style="text-align: justify;">
Most Affected Countries</h3>
<div style="text-align: justify;">
Here's the list of Top 10 countries that are affected by SSH/HTTPS encryption key reuse:</div>
<div style="text-align: justify;">
</div>
<ul>
<li>United States</li>
<li>Mexico</li>
<li>Brazil</li>
<li>Spain</li>
<li>Colombia</li>
<li>Canada</li>
<li>China</li>
<li>Russian Federation</li>
<li>Taiwan</li>
<li>United Kingdom</li>
</ul>
<div style="text-align: justify;">
SEC Consult has<i> "worked together with CERT/CC to address this issue since early August 2015."</i> and it recommends vendors to use securely random cryptographic keys for each IoT-capable device.</div>
<div style="text-align: justify;">
</div>
<div style="text-align: justify;">
Moreover, ISPs are advised to make sure that there is no possibility to 
remotely access CPE (customer premises equipment) devices via WAN port. 
In case they need access for remote support purposes, <i>"setting up a dedicated management VLAN with strict ACLs is recommended."</i></div>
</span></span><span style="font-family: Georgia,"Times New Roman",serif;"> </span></div>
</div>
<span style="font-family: Georgia,"Times New Roman",serif;"> </span></div>
</div>

Hacker Hacking news Latest News Security news Millions of IoT Devices Using Same Hard-Coded CRYPTO Keys

Millions of embedded devices, including home routers, modems, IP cameras, VoIP phones, are shareing the same hard-coded SSH (Secure...

Hackers Can Remotely Record and Listen Calls from Your Samsung Galaxy Phones

10:31 PM Unknown 0

<div dir="ltr" style="text-align: left;" trbidi="on">
<div dir="ltr" style="text-align: left;" trbidi="on">
<div class="separator" style="clear: both; text-align: center;">
<a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEg64HEiVKtUKhWxZQwnj6yK5mJXL43XdCLEQBvjWB0u2e-jBHanGV-xdRMMhsgtv9Csva9EXz4Kfl2bWsLtbtTLEeLqufL3PZytUf4YKR0fDEoordGHGjdUnRuyq9H3GWGwZyTqmQBqLlU/s1600/samsung-phones%255B1%255D.png" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" height="334" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEg64HEiVKtUKhWxZQwnj6yK5mJXL43XdCLEQBvjWB0u2e-jBHanGV-xdRMMhsgtv9Csva9EXz4Kfl2bWsLtbtTLEeLqufL3PZytUf4YKR0fDEoordGHGjdUnRuyq9H3GWGwZyTqmQBqLlU/s640/samsung-phones%255B1%255D.png" width="640" /></a></div>
<br />
<div style="background-color: white; border: 0px; font-family: 'PT Sans', arial, sans-serif; font-size: 17px; font-stretch: inherit; line-height: 30px; margin: 0px; outline: 0px; padding: 0px; text-align: justify; vertical-align: baseline;">
If you own a <b style="border: 0px; font-family: inherit; font-size: inherit; font-stretch: inherit; font-style: inherit; font-variant: inherit; line-height: inherit; margin: 0px; outline: 0px; padding: 0px; vertical-align: baseline;">Samsung Galaxy Phone </b>– <b style="border: 0px; font-family: inherit; font-size: inherit; font-stretch: inherit; font-style: inherit; font-variant: inherit; line-height: inherit; margin: 0px; outline: 0px; padding: 0px; vertical-align: baseline;">S6, S6 Edge</b> or <b style="border: 0px; font-family: inherit; font-size: inherit; font-stretch: inherit; font-style: inherit; font-variant: inherit; line-height: inherit; margin: 0px; outline: 0px; padding: 0px; vertical-align: baseline;">Note 4</b>, in particular – there are chances that a skilled hacker could remotely intercept your voice calls to listen in and even record all your voice conversations.</div>
<div style="background-color: white; border: 0px; font-family: 'PT Sans', arial, sans-serif; font-size: 17px; font-stretch: inherit; line-height: 30px; margin: 0px; outline: 0px; padding: 0px; text-align: justify; vertical-align: baseline;">
<br style="content: " "; display: block; margin: 20px 0px 0px; outline: 0px; padding: 0px;" /></div>
<div style="background-color: white; border: 0px; font-family: 'PT Sans', arial, sans-serif; font-size: 17px; font-stretch: inherit; line-height: 30px; margin: 0px; outline: 0px; padding: 0px; text-align: justify; vertical-align: baseline;">
Two security researchers, <b style="border: 0px; font-family: inherit; font-size: inherit; font-stretch: inherit; font-style: inherit; font-variant: inherit; line-height: inherit; margin: 0px; outline: 0px; padding: 0px; vertical-align: baseline;">Daniel Komaromy </b>of San Francisco and <b style="border: 0px; font-family: inherit; font-size: inherit; font-stretch: inherit; font-style: inherit; font-variant: inherit; line-height: inherit; margin: 0px; outline: 0px; padding: 0px; vertical-align: baseline;">Nico Golde</b> of Berlin, have demonstrated exactly the same during a security conference in Tokyo.</div>
<div style="background-color: white; border: 0px; font-family: 'PT Sans', arial, sans-serif; font-size: 17px; font-stretch: inherit; line-height: 30px; margin: 0px; outline: 0px; padding: 0px; text-align: justify; vertical-align: baseline;">
<br style="content: " "; display: block; margin: 20px 0px 0px; outline: 0px; padding: 0px;" /></div>
<div style="background-color: white; border: 0px; font-family: 'PT Sans', arial, sans-serif; font-size: 17px; font-stretch: inherit; line-height: 30px; margin: 0px; outline: 0px; padding: 0px; text-align: justify; vertical-align: baseline;">
The duo demonstrated a <b style="border: 0px; font-family: inherit; font-size: inherit; font-stretch: inherit; font-style: inherit; font-variant: inherit; line-height: inherit; margin: 0px; outline: 0px; padding: 0px; vertical-align: baseline;">man-in-the-middle (MITM) attack</b> on an out-of-the-box and most updated Samsung handset that allowed them to intercept voice calls by connecting the device to fake cellular base stations.</div>
<div style="background-color: white; border: 0px; font-family: 'PT Sans', arial, sans-serif; font-size: 17px; font-stretch: inherit; line-height: 30px; margin: 0px; outline: 0px; padding: 0px; text-align: justify; vertical-align: baseline;">
<br /></div>
<div style="background-color: white; border: 0px; font-family: 'PT Sans', arial, sans-serif; font-size: 17px; font-stretch: inherit; line-height: 30px; margin: 0px; outline: 0px; padding: 0px; text-align: justify; vertical-align: baseline;">
<div style="border: 0px; font-stretch: inherit; margin: 0px; outline: 0px; padding: 0px; vertical-align: baseline;">
The issue actually resides in the <b style="border: 0px; font-family: inherit; font-size: inherit; font-stretch: inherit; font-style: inherit; font-variant: inherit; line-height: inherit; margin: 0px; outline: 0px; padding: 0px; vertical-align: baseline;">Samsung's baseband chip</b>, which comes in Samsung handsets, that handles voice calls but is not directly accessible to the end user.</div>
<div style="border: 0px; font-stretch: inherit; margin: 0px; outline: 0px; padding: 0px; vertical-align: baseline;">
<br style="content: " "; display: block; margin: 20px 0px 0px; outline: 0px; padding: 0px;" /></div>
<h3 style="border: 0px; font-size: 1.4em; font-stretch: inherit; margin: 0px; outline: 0px; padding: 0px; vertical-align: baseline;">
How to Intercept Voice Calls?</h3>
<div style="border: 0px; font-stretch: inherit; margin: 0px; outline: 0px; padding: 0px; vertical-align: baseline;">
<br style="content: " "; display: block; margin: 20px 0px 0px; outline: 0px; padding: 0px;" /></div>
<div style="border: 0px; font-stretch: inherit; margin: 0px; outline: 0px; padding: 0px; vertical-align: baseline;">
The researchers set up a bogus <b style="border: 0px; font-family: inherit; font-size: inherit; font-stretch: inherit; font-style: inherit; font-variant: inherit; line-height: inherit; margin: 0px; outline: 0px; padding: 0px; vertical-align: baseline;">OpenBTS base station</b> that nearby Samsung devices, including the latest <b style="border: 0px; font-family: inherit; font-size: inherit; font-stretch: inherit; font-style: inherit; font-variant: inherit; line-height: inherit; margin: 0px; outline: 0px; padding: 0px; vertical-align: baseline;">Samsung S6 and S6 Edge</b>, think is a legitimate cellular tower.</div>
<div style="border: 0px; font-stretch: inherit; margin: 0px; outline: 0px; padding: 0px; vertical-align: baseline;">
<br style="content: " "; display: block; margin: 20px 0px 0px; outline: 0px; padding: 0px;" /></div>
<div style="border: 0px; font-stretch: inherit; margin: 0px; outline: 0px; padding: 0px; vertical-align: baseline;">
Once connected to it, the bogus base station remotely tinkers with the phone's baseband processor even without any knowledge of the user.</div>
<div style="border: 0px; font-stretch: inherit; margin: 0px; outline: 0px; padding: 0px; vertical-align: baseline;">
<br style="content: " "; display: block; margin: 20px 0px 0px; outline: 0px; padding: 0px;" /></div>
<div style="border: 0px; font-stretch: inherit; margin: 0px; outline: 0px; padding: 0px; vertical-align: baseline;">
This gives an attacker ability to intercept, listen, and even record your phone calls. In short, the hack attack is a cellular MITM attack, and users have no idea what's happening</div>
<div style="border: 0px; font-stretch: inherit; margin: 0px; outline: 0px; padding: 0px; vertical-align: baseline;">
<br style="content: " "; display: block; margin: 20px 0px 0px; outline: 0px; padding: 0px;" /></div>
<div style="border: 0px; font-stretch: inherit; margin: 0px; outline: 0px; padding: 0px; vertical-align: baseline;">
<b style="border: 0px; font-family: inherit; font-size: inherit; font-stretch: inherit; font-style: inherit; font-variant: inherit; line-height: inherit; margin: 0px; outline: 0px; padding: 0px; vertical-align: baseline;">Must Read: </b><span style="border: 0px; color: #cc0000; font-family: inherit; font-size: inherit; font-stretch: inherit; font-style: inherit; font-variant: inherit; font-weight: inherit; line-height: inherit; margin: 0px; outline: 0px; padding: 0px; text-align: left; vertical-align: baseline;"><b style="border: 0px; font-family: inherit; font-size: inherit; font-stretch: inherit; font-style: inherit; font-variant: inherit; line-height: inherit; margin: 0px; outline: 0px; padding: 0px; vertical-align: baseline;"><a href="http://www.hackntech.net/2015/11/researcher-hijacks-android-phone-via.html" rel="nofollow" target="_blank">Chrome Zero-day Exploit leaves MILLIONS of Android devices vulnerable to Remote Hacking</a></b></span></div>
<div style="border: 0px; font-stretch: inherit; margin: 0px; outline: 0px; padding: 0px; vertical-align: baseline;">
<br style="content: " "; display: block; margin: 20px 0px 0px; outline: 0px; padding: 0px;" /></div>
<div style="border: 0px; font-stretch: inherit; margin: 0px; outline: 0px; padding: 0px; vertical-align: baseline;">
However, given the requirements to make such an attack possible, an everyday hacker can not be able to execute the hack.</div>
<blockquote style="background-color: #f9f9f9; border-left-color: rgb(191, 202, 218); border-left-style: solid; border-width: 0px 0px 0px 8px; font-stretch: inherit; margin: 10px; outline: 0px; padding: 10px; quotes: none; vertical-align: baseline;">
<i style="border: 0px; font-family: inherit; font-size: inherit; font-stretch: inherit; font-variant: inherit; font-weight: inherit; line-height: inherit; margin: 0px; outline: 0px; padding: 0px; vertical-align: baseline;">"Our example of modifying the baseband to hijack calls is just an example," Komaromy </i><a href="http://www.theregister.co.uk/2015/11/12/mobile_pwn2own1/" rel="nofollow" style="border: 0px; color: #3d5a99; font-family: inherit; font-size: inherit; font-stretch: inherit; font-style: inherit; font-variant: inherit; font-weight: bold; line-height: inherit; margin: 0px; outline: none; padding: 0px; text-decoration: none; vertical-align: baseline;" target="_blank">told</a> the Reg.<i style="border: 0px; font-family: inherit; font-size: inherit; font-stretch: inherit; font-variant: inherit; font-weight: inherit; line-height: inherit; margin: 0px; outline: 0px; padding: 0px; vertical-align: baseline;"> "The idea with hijacking would be that you can redirect calls to a proxy and that way you can man-in-the-middle the call. So that means the caller sees her original call connected – but it can be recorded in the proxy [which is how] it is like a wiretap implant."</i></blockquote>
<div style="border: 0px; font-stretch: inherit; margin: 0px; outline: 0px; padding: 0px; vertical-align: baseline;">
The pair has reported their findings to Samsung and kept the details of the attack out of the reach of the public. Hopefully, the company will address the security hole promptly.</div>
</div>
</div>
<br />
<script async="" src="//pagead2.googlesyndication.com/pagead/js/adsbygoogle.js"></script>

<br />
<ins class="adsbygoogle" data-ad-client="ca-pub-7726750987177406" data-ad-format="auto" data-ad-slot="7596682374" style="display: block;"></ins><script>
(adsbygoogle = window.adsbygoogle || []).push({});
</script>
</div>

Hacker Hacking news Latest News Security news Smartphone Hackers Can Remotely Record and Listen Calls from Your Samsung Galaxy Phones

If you own a Samsung Galaxy Phone – S6, S6 Edge or Note 4 , in particular – there are chances that a skilled hacker could remotel...

Researcher Hijacks Android Phone via Chrome Vulnerability

9:17 PM Unknown 0

<div dir="ltr" style="text-align: left;" trbidi="on">
<div dir="ltr" style="text-align: left;" trbidi="on">
<div class="MsoNormal" style="background-color: white; color: #333333; font-family: Verdana, Arial, Helvetica, sans-serif; font-size: 12px; line-height: 20px;">
<div class="separator" style="clear: both; text-align: center;">
<a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEix_g_PCLWPYz1I4YzFe3KIzfP38dOhfsqv0DRjxgt9H8uwswBqGGDVa7hvnfHv_LkY7SrgpZT1Hf0bmim5IkVqtSgjbcERHVxrOgMAXjqQI6_TfO_bxS5pztOIlarLMnPzLXwX0HwXLMY/s1600/android-exploit.jpg" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" height="426" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEix_g_PCLWPYz1I4YzFe3KIzfP38dOhfsqv0DRjxgt9H8uwswBqGGDVa7hvnfHv_LkY7SrgpZT1Hf0bmim5IkVqtSgjbcERHVxrOgMAXjqQI6_TfO_bxS5pztOIlarLMnPzLXwX0HwXLMY/s640/android-exploit.jpg" width="640" /></a></div>
<span style="font-size: small;"><span style="font-family: "trebuchet ms" , "geneva";"><strong><br /></strong></span></span>
<span style="font-size: small;"><span style="font-family: "trebuchet ms" , "geneva";"><strong>Over the past few months, Google has been busy squashing security vulnerabilities in its popular Android mobile operating system, but many remain undiscovered, and some can be easily exploited.</strong></span></span></div>
<div class="MsoNormal" style="background-color: white; color: #333333; font-family: Verdana, Arial, Helvetica, sans-serif; font-size: 12px; line-height: 20px;">
<span style="font-size: small;"><span style="font-family: "trebuchet ms" , "geneva";"><strong><br /></strong></span></span></div>
<div class="MsoNormal" style="background-color: white; color: #333333; font-family: Verdana, Arial, Helvetica, sans-serif; font-size: 12px; line-height: 20px;">
<span style="font-size: small;"><span style="font-family: "trebuchet ms" , "geneva";">Chinese researcher <a href="https://twitter.com/oldfresher" style="color: #0076b4; font-weight: bold; text-decoration: none;">Guang Gong</a> from Qihoo 360 demonstrated at <strong>MobilePwn2Own</strong> at the PacSec conference in Tokyo how an Android device running the latest version of the operating system can be hijacked by exploiting a JavaScript v8 vulnerability through the Chrome browser. Granted, the security flaw did not reside in the Android OS itself, but devices running on the platform are vulnerable.</span></span></div>
<div class="MsoNormal" style="background-color: white; color: #333333; font-family: Verdana, Arial, Helvetica, sans-serif; font-size: 12px; line-height: 20px;">
<span style="font-size: small;"><span style="font-family: "trebuchet ms" , "geneva";"></span></span><span style="font-family: "trebuchet ms" , "geneva"; font-size: small;">Gong discovered a JavaScript v8 vulnerability in Chrome for Android that allowed him to install an arbitrary application on the affected device, in this case a BMX Bike game, without requiring any user interaction, PacSec organizer Dragos Ruiu explained in a </span><a href="https://plus.google.com/103470457057356043365/posts/KLDx2YJKSg8" style="color: #0076b4; font-family: 'trebuchet ms', geneva; font-size: medium; font-weight: bold; text-decoration: none;" target="_blank">Google+ post</a><span style="font-family: "trebuchet ms" , "geneva"; font-size: small;">. As long as Chrome is used to navigate to a malicious site an attacker set up, the device can be infected.</span></div>
<div class="MsoNormal" style="background-color: white; color: #333333; font-family: Verdana, Arial, Helvetica, sans-serif; font-size: 12px; line-height: 20px;">
<span style="font-family: "trebuchet ms" , "geneva"; font-size: small;"><br /></span></div>
<div class="MsoNormal" style="background-color: white; color: #333333; font-family: Verdana, Arial, Helvetica, sans-serif; font-size: 12px; line-height: 20px;">
<span style="font-size: small;"><span style="font-family: "trebuchet ms" , "geneva";">The exploit was demonstrated on a Google Project Fi Nexus 6 running the latest Android 6.0 Marshmallow build and with all applications up-to-date. The researcher demonstrated that the vulnerability could provide an attacker with complete control of the device, and that successful exploitation does not require chaining multiple vulnerabilities.</span></span></div>
<div class="MsoNormal" style="background-color: white; color: #333333; font-family: Verdana, Arial, Helvetica, sans-serif; font-size: 12px; line-height: 20px;">
<span style="font-size: small;"><span style="font-family: "trebuchet ms" , "geneva";">This one shot exploit was revealed after three-months of work, Ruiu said, but exact details on the security flaw were not publicly disclosed. According to Ruiu, the exploit was tested on other devices as well, and it worked on all of them.</span></span></div>
<div class="MsoNormal" style="background-color: white; color: #333333; font-family: Verdana, Arial, Helvetica, sans-serif; font-size: 12px; line-height: 20px;">
<span style="font-size: small;"><span style="font-family: "trebuchet ms" , "geneva";">Given that the vulnerability is in the JavaScript engine in Chrome, it is believed to affect all Android versions with the latest version of the browser installed. Details on the vulnerability were handed to a Chrome engineer at the conference, Ruiu announced <a href="https://twitter.com/dragosr/status/664367172718751744" style="color: #0076b4; font-weight: bold; text-decoration: none;">via Twitter</a>.</span></span></div>
<div class="MsoNormal" style="background-color: white; color: #333333; font-family: Verdana, Arial, Helvetica, sans-serif; font-size: 12px; line-height: 20px;">
<span style="font-size: small;"><span style="font-family: "trebuchet ms" , "geneva";">Unfortunately for Gong, his presentation at the conference did not result in an immediate reward for his efforts, though it is likely that Google will reward him for discovering the vulnerability, as the company has a <a href="https://www.google.com/about/appsecurity/chrome-rewards/" style="color: #0076b4; font-weight: bold; text-decoration: none;">bug bounty program</a> set up for Chrome and Chrome OS.</span></span></div>
<div class="MsoNormal" style="background-color: white; color: #333333; font-family: Verdana, Arial, Helvetica, sans-serif; font-size: 12px; line-height: 20px;">
<span style="font-size: small;"><span style="font-family: "trebuchet ms" , "geneva";">“Since we don't have any lavish prizes for him, I'm bringing him to Canada next year for some skiing/snowboarding at CanSecWest,” Ruiu said, so it seems that a prize will be coming from the PacSec organizers.</span></span></div>
<div class="MsoNormal" style="background-color: white; color: #333333; font-family: Verdana, Arial, Helvetica, sans-serif; font-size: 12px; line-height: 20px;">
<span style="font-size: small;"><span style="font-family: "trebuchet ms" , "geneva";">Google will most likely resolve the vulnerability soon, even if the details on the exploit haven’t been made public as of now.</span></span></div>
<div style="background-color: white; color: #333333; font-family: Verdana, Arial, Helvetica, sans-serif; font-size: 12px; line-height: 20px;">
</div>
<div class="MsoNormal" style="background-color: white; color: #333333; font-family: Verdana, Arial, Helvetica, sans-serif; font-size: 12px; line-height: 20px;">
<span style="font-size: small;"><span style="font-family: "trebuchet ms" , "geneva";">Security researchers have discovered a series of critical Android vulnerabilities this year, including the Stagefright flaw that affected close to a billion devices, and a Stagefright 2 issuesuspected to affect devices running all Android versions, starting with the initial release.</span></span></div>
</div>
<br />
<script async="" src="//pagead2.googlesyndication.com/pagead/js/adsbygoogle.js"></script>

<br />
<ins class="adsbygoogle" data-ad-client="ca-pub-7726750987177406" data-ad-format="auto" data-ad-slot="7596682374" style="display: block;"></ins><script>
(adsbygoogle = window.adsbygoogle || []).push({});
</script>
</div>

Hacking news Latest News Security news Vulnerabilities Researcher Hijacks Android Phone via Chrome Vulnerability

Over the past few months, Google has been busy squashing security vulnerabilities in its popular Android mobile operating system, but ...

New PoS Malware Delivered via Malicious Docs, Exploit Kit

10:32 PM Unknown 0

<div dir="ltr" style="text-align: left;" trbidi="on">
<div dir="ltr" style="text-align: left;" trbidi="on">
<div style="background-color: white; color: #333333; font-family: Verdana, Arial, Helvetica, sans-serif; font-size: 12px; line-height: 20px;">
<div class="separator" style="clear: both; text-align: center;">
<a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjRko6im2Vdzc9n0dmnIYty5Ygi8Gk8U1PD56ye2nkcKsEhQH5Sz5R70Xb0K914RrrHmD7ewwJU8q5c3MVVPkyAudsBi9Fr35Mb4Y7-4Q5tyQWKbaiW18Rx_xd57YDdzbrW4hyMzlVBwOg/s1600/new-point-of-sale-%2528PoS%2529-malware.jpg" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" height="458" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjRko6im2Vdzc9n0dmnIYty5Ygi8Gk8U1PD56ye2nkcKsEhQH5Sz5R70Xb0K914RrrHmD7ewwJU8q5c3MVVPkyAudsBi9Fr35Mb4Y7-4Q5tyQWKbaiW18Rx_xd57YDdzbrW4hyMzlVBwOg/s640/new-point-of-sale-%2528PoS%2529-malware.jpg" width="640" /></a></div>
<strong><span style="font-size: small;"><span style="font-family: "trebuchet ms" , "geneva";"><br /></span></span></strong>
<strong><span style="font-size: small;"><span style="font-family: "trebuchet ms" , "geneva";"><br /></span></span></strong>
<strong><span style="font-size: small;"><span style="font-family: "trebuchet ms" , "geneva";">A new point-of-sale (PoS) malware has been widely distributed by cybercriminals alongside ad fraud and information-stealing threats.</span></span></strong></div>
<div style="background-color: white; color: #333333; font-family: Verdana, Arial, Helvetica, sans-serif; font-size: 12px; line-height: 20px;">
<strong><span style="font-size: small;"><span style="font-family: "trebuchet ms" , "geneva";"><br /></span></span></strong></div>
<div style="background-color: white; color: #333333; font-family: Verdana, Arial, Helvetica, sans-serif; font-size: 12px; line-height: 20px;">
<span style="font-size: small;"><span style="font-family: "trebuchet ms" , "geneva";">The malware, dubbed by Proofpoint “<a href="https://www.proofpoint.com/us/threat-insight/post/AbaddonPOS-A-New-Point-Of-Sale-Threat-Linked-To-Vawtrak" style="color: #0076b4; font-weight: bold; text-decoration: none;" target="_blank">AbaddonPOS</a>,” has been spotted on systems infected with the banking Trojan Vawtrak, also known as Neverquest and Snifula.</span></span></div>
<div style="background-color: white; color: #333333; font-family: Verdana, Arial, Helvetica, sans-serif; font-size: 12px; line-height: 20px;">
<span style="font-size: small;"><span style="font-family: "trebuchet ms" , "geneva";">PoS malware can help cybercriminals earn a lot of money, but such threats are often used in more targeted attacks. However, researchers have spotted AbaddonPOS in campaigns that appear to be mainly aimed at consumers.</span></span></div>
<div style="background-color: white; color: #333333; font-family: Verdana, Arial, Helvetica, sans-serif; font-size: 12px; line-height: 20px;">
<span style="font-size: small;"><span style="font-family: "trebuchet ms" , "geneva";">Anti-malware company Cyphort <a href="http://www.cyphort.com/psychcental-com-infected-with-angler-ek-installs-bedep-vawtrak-and-pos-malware/" style="color: #0076b4; font-weight: bold; text-decoration: none;" target="_blank">reported</a> in early November that the psychcentral.com website had been directing users to the Angler exploit kit. Angler had been set up to serve the ad fraud malware Bedep, the Vawtrak banking Trojan, and a new RAM scraping malware designed to scan running processes for payment card information.</span></span></div>
<div style="background-color: white; color: #333333; font-family: Verdana, Arial, Helvetica, sans-serif; font-size: 12px; line-height: 20px;">
<span style="font-size: small;"><span style="font-family: "trebuchet ms" , "geneva";">Proofpoint observed the same PoS malware, namely AbaddonPOS, being distributed with the aid of weaponized Microsoft Word documents designed to download the information-stealing Trojan Pony (Fareit) and Vawtrak.</span></span></div>
<div style="background-color: white; color: #333333; font-family: Verdana, Arial, Helvetica, sans-serif; font-size: 12px; line-height: 20px;">
<span style="font-size: small;"><span style="font-family: "trebuchet ms" , "geneva";">According to researchers, in both the exploit kit and weaponized document attacks, Vawtrak and Bedep download TinyLoader, a downloader designed to fetch executable payloads from a command and control (C&C) server using a custom protocol. In the attacks observed by Proofpoint, TinyLoader transfers a second downloader, TinyDownloader, in the form of a shellcode, which in turn downloads AbaddonPOS.</span></span></div>
<div style="background-color: white; color: #333333; font-family: Verdana, Arial, Helvetica, sans-serif; font-size: 12px; line-height: 20px;">
<span style="font-size: small;"><span style="font-family: "trebuchet ms" , "geneva";">The threat is small in size (5Kb) and its core functionality is simple, but it includes some noteworthy features. Experts say AbaddonPOS relies on several basic anti-analysis and obfuscation techniques that make it more difficult to investigate via both manual and automated methods.</span></span></div>
<div style="background-color: white; color: #333333; font-family: Verdana, Arial, Helvetica, sans-serif; font-size: 12px; line-height: 20px;">
<span style="font-size: small;"><span style="font-family: "trebuchet ms" , "geneva";">Once it infects a system, the malware reads the memory of all processes in search of track 1 and track 2 data associated with payment cards. After it finds the targeted financial information, AbaddonPOS sends it back to its C&C server using a custom binary protocol, unlike other PoS malware families that use HTTP for this task. C&C communications and credit card data exfiltration is handled by the shellcode downloaded by TinyLoader.</span></span></div>
<div style="background-color: white; color: #333333; font-family: Verdana, Arial, Helvetica, sans-serif; font-size: 12px; line-height: 20px;">
<span style="font-size: small;"><span style="font-family: "trebuchet ms" , "geneva";">TinyLoader was first spotted in January 2015 and it underwent several modifications since, including the addition of anti-analysis and obfuscation/encoding features. Since the code used for anti-analysis and obfuscation is similar in AbaddonPOS and TinyLoader, Proofpoint believes the threats are connected and possibly even developed by the same authors.</span></span></div>
<div style="background-color: white; color: #333333; font-family: Verdana, Arial, Helvetica, sans-serif; font-size: 12px; line-height: 20px;">
<span style="font-size: small;"><span style="font-family: "trebuchet ms" , "geneva";">“The practice of threat actors to increase their target surfaces by leveraging a single campaign to deliver multiple payloads is by now a well-established practice,” Proofpoint researchers said. “While using this technique to deliver point of sale malware is less common, the approach of the US holiday shopping season gives cybercriminals ample reason to maximize the return on their campaigns by distributing a new, powerful PoS malware that can capture the credit and debit card transactions of holiday shoppers.”</span></span></div>
<div style="background-color: white; color: #333333; font-family: Verdana, Arial, Helvetica, sans-serif; font-size: 12px; line-height: 20px;">
<span style="font-size: small;"><span style="font-family: "trebuchet ms" , "geneva";">AbaddonPOS is not the only PoS malware analyzed recently by researchers. Trustwave has been monitoring a threat, dubbed “Cherry Picker,” that has managed to stay under the radar since 2011 thanks to its sophisticated functionality and the use of a cleaner that restores the system to a clean state after data is stolen. Unlike AbaddonPOS, Cherry Picker has only been used in highly targeted attacks.</span></span></div>
</div>
<br />
<script async="" src="//pagead2.googlesyndication.com/pagead/js/adsbygoogle.js"></script>

<br />
<ins class="adsbygoogle" data-ad-client="ca-pub-7726750987177406" data-ad-format="auto" data-ad-slot="7596682374" style="display: block;"></ins><script>
(adsbygoogle = window.adsbygoogle || []).push({});
</script>
</div>

Cyber Crime Hacking news Malware Security news New PoS Malware Delivered via Malicious Docs, Exploit Kit

A new point-of-sale (PoS) malware has been widely distributed by cybercriminals alongside ad fraud and information-stealing threats. ...

Hackers have Hacked into US Arrest Records Database

9:35 PM Unknown 0

<div dir="ltr" style="text-align: left;" trbidi="on">
<div class="separator" style="clear: both; text-align: center;">
<a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEi083n3dOIGouJLarPkBPHjmmMrkPW_IjVmyYd8AjCUdUSqUL9xB8bs2g3i9ovLXfi8MhGyEFmAlbfDvR8APqMcmz1WZgcLz7Gf6HyR6HvxV6X7LnIQ8XIxwMh2QLt_Y645Vqtdyxmuea4/s1600/JABS.png" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" height="474" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEi083n3dOIGouJLarPkBPHjmmMrkPW_IjVmyYd8AjCUdUSqUL9xB8bs2g3i9ovLXfi8MhGyEFmAlbfDvR8APqMcmz1WZgcLz7Gf6HyR6HvxV6X7LnIQ8XIxwMh2QLt_Y645Vqtdyxmuea4/s640/JABS.png" style="cursor: move;" width="640" /></a></div>
                                                         <br />
<span style="font-family: "georgia" , "times new roman" , serif;"><span class="main-article-info"></span></span><span style="font-family: "georgia" , "times new roman" , serif;"><span class="main-article-info"></span></span><br />
<div style="text-align: justify;">
<span style="font-family: "georgia" , "times new roman" , serif;"><span class="main-article-info">The Group of teenage hackers, which previously hacked into the personal email of the CIA director <b>John Brennan </b>and published a large trove of sensitive data, has now had its hands on even more important and presumably secure target.</span></span></div>
<span style="font-family: "georgia" , "times new roman" , serif;"><span class="main-article-info">
<h3 style="text-align: justify;">
<span style="font-size: large;">Hackers Accessed Law Enforcement Private Portal</span></h3>
<div style="text-align: justify;">
The hacking group, <b>Crackas With Attitude</b> (<b>CWA</b>), claims it has gained access to a <b>Law Enforcement Portal </b>through which one can access:</div>
<ul style="text-align: left;">
<li style="text-align: justify;">Arrest records</li>
<li style="text-align: justify;">Tools for sharing information about terrorist events and active shooters</li>
</ul>
<div style="text-align: justify;">
The system in question is reportedly known as the <b>Joint Automated Booking System </b>(<b>JABS</b>), which is only available to the Federal Bureau of Investigation (FBI) and law enforcement.</div>
<div style="text-align: justify;">
<span class="main-article-info"></span><br />
<h3 style="text-align: justify;">
<span class="main-article-info">
<span style="font-size: large;">Hackers Gained Access to FBI's Real-Time Chat System</span></span></h3>
<span class="main-article-info">
<div style="text-align: justify;">
Moreover, the hacking group also says it has gained access to another 
tool that is something like a real-time chat system for the FBI to 
communicate with other law enforcement agents around the US.</div>
<div style="text-align: justify;">
</div>
<br />
<script async src="//pagead2.googlesyndication.com/pagead/js/adsbygoogle.js"></script>

<ins class="adsbygoogle"
     style="display:block"
     data-ad-client="ca-pub-7726750987177406"
     data-ad-slot="7596682374"
     data-ad-format="auto"></ins>
<script>
(adsbygoogle = window.adsbygoogle || []).push({});
</script>
<br />
<div style="text-align: justify;">
Two days ago, CWA published a portion of the data it collected to Pastebin and Cryptobin, apparently releasing names, email addresses, and phone numbers of around 3,500 law enforcement and military personnel.</div>
<h3 style="text-align: justify;">
<span style="font-size: large;">JABS System Hacked!</span></h3>
<div style="text-align: justify;">
However, the group has been able to have its hands on many law 
enforcement tools that contain more sensitive information, and Wired 
verified that a screenshot of JABS shared by CWA was legitimate.<br />
</div>
<div style="text-align: justify;">
</div>
<div style="text-align: justify;">
The CWA hackers <a href="http://www.wired.com/2015/11/cia-email-hackers-return-with-major-law-enforcement-breach/" rel="nofollow" target="_blank">told</a>
 Wired they found a vulnerability that allowed them to gain access to 
the law enforcement private portal, giving the group access to dozen law
 enforcement tools, but the hackers didn't reveal anything about the 
vulnerability.<br />
</div>
<div style="text-align: justify;">
</div>
<div style="text-align: justify;">
This system is noteworthy as it may allow anyone with access to view 
arrest records – whether the arrests are sealed or aren't available to 
the public.<br />
</div>
<div style="text-align: justify;">
</div>
<div style="text-align: justify;">
It means, among other things, this system can expose secret informants 
and others who have been detained but are now working with the law 
enforcement agencies.
<br />
<script async src="//pagead2.googlesyndication.com/pagead/js/adsbygoogle.js"></script>

<ins class="adsbygoogle"
     style="display:block"
     data-ad-client="ca-pub-7726750987177406"
     data-ad-slot="7596682374"
     data-ad-format="auto"></ins>
<script>
(adsbygoogle = window.adsbygoogle || []).push({});
</script><br />
</div>
<div style="text-align: justify;">
</div>
<div style="text-align: justify;">
Although none of the information from these law enforcement tools has 
been shared publicly, the hacking group could bother government 
officials by releasing the sensitive information anytime soon.</div>
</span> </div>
</span></span></div>

Hacking news Latest News Security news Hackers have Hacked into US Arrest Records Database

The Group of teenage hackers, which previously hacked into the personal email...

"Teen" Hackers Strike Again, Leak Info of Government Employees

12:54 AM Unknown 0

<div dir="ltr" style="text-align: left;" trbidi="on">
<div class="separator" style="clear: both; text-align: center;">
<a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjR4lZLtQbm9WqMYulNfxtSHM2fvbEfgpFsJgBdooHV3hTUAaMyC0N_W9rfI6VsxVlMb5zd0LSQxH7bw4R0N759VE6RCUf9u0I7Ti2jzbQxdv0mbepKJYpVwKAERqciW23EYWM9gvYJCx0/s1600/Teen-Hackers-Strike-Again-Leak-Info-of-Government-Employees.jpg" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" height="394" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjR4lZLtQbm9WqMYulNfxtSHM2fvbEfgpFsJgBdooHV3hTUAaMyC0N_W9rfI6VsxVlMb5zd0LSQxH7bw4R0N759VE6RCUf9u0I7Ti2jzbQxdv0mbepKJYpVwKAERqciW23EYWM9gvYJCx0/s640/Teen-Hackers-Strike-Again-Leak-Info-of-Government-Employees.jpg" width="640" /></a></div>
<span style="font-family: Georgia,"Times New Roman",serif;">The same "stoner teens" who hacked CIA director John Brennan's AOL account are back. Today, "Crackas With Attitude" posted the contact information of government employees online-and they claim to have accessed far more than that. </span><br />
<br />
<span style="font-family: Georgia,"Times New Roman",serif;">"34,000 lines of emails, names, position and phone numbers of gov 
associates, including military," one of the hackers bragged about how 
many government names they bagged. His account is now <a href="https://twitter.com/phphax" rel="nofollow" target="_blank">deleted</a>. Motherboard <a href="http://motherboard.vice.com/read/teenage-hackers-say-theyve-doxxed-more-than-3500-government-employees" rel="nofollow" target="_blank">spoke to the hackers</a>, who claim they gained access to a lot more than the information shared today:</span>
<br />
<script async src="//pagead2.googlesyndication.com/pagead/js/adsbygoogle.js"></script>

<ins class="adsbygoogle"
     style="display:block"
     data-ad-client="ca-pub-7726750987177406"
     data-ad-slot="7596682374"
     data-ad-format="auto"></ins>
<script>
(adsbygoogle = window.adsbygoogle || []).push({});
</script><br />
<blockquote>
<span style="font-family: Georgia,"Times New Roman",serif;">Earlier
 on Thursday, Cracka told Motherboard that the group hacked into 
someone's account, and got access to several "tools feds use" such as <a href="http://www.justice.gov/sites/default/files/jmd/legacy/2014/06/27/jabs.pdf" rel="nofollow" target="_blank">JABS</a>, a database of arrested people, <a href="http://www.ic3.gov/about/default.aspx" rel="nofollow" target="_blank">IC3</a>, an FBI crime-reporting tool, and <a href="https://www.fbi.gov/about-us/cjis/leep-law-enforcement-enterprise-portal/vcc_sig" rel="nofollow" target="_blank">VCC</a>,
 a sharing tool for law enforcement agencies. He declined to say whose 
account they hijacked, only that the owner is someone "high in the 
[government]."</span></blockquote>
<span style="font-family: Georgia,"Times New Roman",serif;">I called some of the numbers of 
government employees, from FBI agents to local law enforcement, and they
 were accurate. That doesn't prove CWA's second dump was legit, since 
there's always a chance CWA could've found the information by other 
means than hacking. Then again, what they released the first time <a href="https://wikileaks.org/cia-emails/" rel="nofollow" target="_blank">turned out to be real</a>. </span>
<br />
<script async src="//pagead2.googlesyndication.com/pagead/js/adsbygoogle.js"></script>

<ins class="adsbygoogle"
     style="display:block"
     data-ad-client="ca-pub-7726750987177406"
     data-ad-slot="7596682374"
     data-ad-format="auto"></ins>
<script>
(adsbygoogle = window.adsbygoogle || []).push({});
</script><br />
</div>

Hacker Hacking news Latest News Security news "Teen" Hackers Strike Again, Leak Info of Government Employees

The same "stoner teens" who hacked CIA director John Brennan's AOL account are back. Today, "Crackas With Attitude...

Powerful DDoS Attack Cripples ProtonMail Service For Days

10:45 PM Unknown 0

<div dir="ltr" style="text-align: left;" trbidi="on">
<div class="separator" style="clear: both; text-align: center;">
<a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgDBUrilwulHKRMN8_YiGwj7YIk94Q3ZPcvHV9Lv9iizzgaru6u_t3kEotmaHN0Fd6KkF4LGCVT9_e6B5FxgvcGF74OfyQukJeABGViWcFjGJRWSPjgGKjVy3ZyPCgpzuDDZKcNkTcFmOQ/s1600/Powerful-DDoS-Attack-Cripples-ProtonMail-Service-For-Days.gif" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" height="358" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgDBUrilwulHKRMN8_YiGwj7YIk94Q3ZPcvHV9Lv9iizzgaru6u_t3kEotmaHN0Fd6KkF4LGCVT9_e6B5FxgvcGF74OfyQukJeABGViWcFjGJRWSPjgGKjVy3ZyPCgpzuDDZKcNkTcFmOQ/s640/Powerful-DDoS-Attack-Cripples-ProtonMail-Service-For-Days.gif" width="640" /></a></div>
<br />
<br />
Geneva-based encrypted email service ProtonMail has been offline for most of the past two days after being targeted by what the company is calling an “extremely powerful DDoS attack.”<br />
<br />
The email service, developed by CERN scientists, was knocked offline on Nov. 3 when attackers started flooding their IP addresses with bogus traffic. Soon after, the company said the attack expanded to the datacenter in Switzerland where the its servers are located, and the service was interrupted.<br />
<br />
The company was not able to stop the attack, but has been working around the clock to get the email service back online. The ProtonMail team managed to restore service briefly on Wednesday, but a new round of DDoS attacks took it down again, the company announced on Twitter.<br />
<br />
<div class="separator" style="clear: both; text-align: center;">
<a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjxQBGYmD7PZ_S5EP-uk3hkt_L5ghittJg-YncBO2WuLHZW6rLa6t7Y3bl9Mv2qj-AdD3-KLLOHHrrK7HhbHPC0XNASSZP9u5_waRLrmbeQW0yRc-wrkKLCaEIauAxWJq5P8D5yjUD4P5g/s1600/protonmail-twitter.jpg" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" height="236" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjxQBGYmD7PZ_S5EP-uk3hkt_L5ghittJg-YncBO2WuLHZW6rLa6t7Y3bl9Mv2qj-AdD3-KLLOHHrrK7HhbHPC0XNASSZP9u5_waRLrmbeQW0yRc-wrkKLCaEIauAxWJq5P8D5yjUD4P5g/s640/protonmail-twitter.jpg" width="640" /></a></div>
<br />
<br />
Following its tweet, the company posted a series of updates on the social networking platform, informing users that the attack was ongoing. ProtonMail reported this morning that another attack was conducted while they were trying to restore the service, and they are still offline at the time of publishing.<br />
<br />
In a blog post, the company explained that the attack took down several other tech companies as well, along with some banks. They also noted that all user data is secure thanks to the implemented end-to-end encryption, although access to the server is limited.<br />
<br />
“To solve this problem we are working with the top companies and people both onsite in our Swiss data center and from around the world. We are confident we will be back online – we just wish it was sooner rather than later,” the company said. In the blog post, the company also appeals to users who have experience with mitigating enterprise level DDOS attacks to help it fend off the intrusion. Additionally, it announced on Twitter that it was looking for a datacenter in Switzerland to move its service to.</div><br>
<script async src="//pagead2.googlesyndication.com/pagead/js/adsbygoogle.js"></script>

<ins class="adsbygoogle"
     style="display:block"
     data-ad-client="ca-pub-7726750987177406"
     data-ad-slot="7596682374"
     data-ad-format="auto"></ins>
<script>
(adsbygoogle = window.adsbygoogle || []).push({});
</script>
<br>

DDoS DDoS Attack Hacking news Latest News Security news Powerful DDoS Attack Cripples ProtonMail Service For Days

Geneva-based encrypted email service ProtonMail has been offline for most of the past two days after being targeted by what the company...

Hackers WIN $1 Million Bounty for Remotely Hacking latest iOS 9 iPhone

10:49 PM Unknown 0

<div dir="ltr" style="text-align: left;" trbidi="on">
<div class="separator" style="clear: both; text-align: center;">
<a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEil46lfE1SMPcpRaLvAG9zr_RHcbpbhYMO1Znj7eMaim6xaumrvN65xp_rsgve-IhyphenhyphenzI23mcJAOIfBBn-MjW8HSuxLFc2C9_FHBe_JXzEWa8lHBHpTBEploKf8ZYVev8dg97QhKkIcm_Tk/s1600/iphone-hacked-jailbreak-zerodium-million-dollar-720x340.jpg" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" height="302" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEil46lfE1SMPcpRaLvAG9zr_RHcbpbhYMO1Znj7eMaim6xaumrvN65xp_rsgve-IhyphenhyphenzI23mcJAOIfBBn-MjW8HSuxLFc2C9_FHBe_JXzEWa8lHBHpTBEploKf8ZYVev8dg97QhKkIcm_Tk/s640/iphone-hacked-jailbreak-zerodium-million-dollar-720x340.jpg" width="640" /></a></div>
<div style="text-align: center;">
<span style="font-family: Arial,Helvetica,sans-serif;"><i> </i></span></div>
<div style="text-align: justify;">
<span style="font-family: Arial,Helvetica,sans-serif;"><i>Well, here's some terrible news for all Apple iOS users…</i></span></div>
<span style="font-family: Arial,Helvetica,sans-serif;"><i>
</i></span><div style="text-align: justify;">
<span style="font-family: Arial,Helvetica,sans-serif;"><i><br /></i></span></div>
<span style="font-family: Arial,Helvetica,sans-serif;"><i>
</i></span><div style="text-align: justify;">
<span style="font-family: Arial,Helvetica,sans-serif;"><i>
Someone just found an iOS zero-day vulnerability that could allow an 
attacker to remotely hack your iPhone running the latest version of iOS,
 i.e. iOS 9.</i></span></div>
<span style="font-family: Arial,Helvetica,sans-serif;"><i>
</i></span><div style="text-align: justify;">
<span style="font-family: Arial,Helvetica,sans-serif;"><i><br /></i></span></div>
<span style="font-family: Arial,Helvetica,sans-serif;"><i>
</i></span><div style="text-align: justify;">
<span style="font-family: Arial,Helvetica,sans-serif;"><i>
Yes, an unknown group of hackers has sold a zero-day vulnerability to <b>Zerodium</b>, a startup by French-based company Vupen that Buys and Sells zero-day exploits.</i></span></div>
<span style="font-family: Arial,Helvetica,sans-serif;"><i>
</i></span><div style="text-align: justify;">
<span style="font-family: Arial,Helvetica,sans-serif;"><i><br /></i></span></div>
<span style="font-family: Arial,Helvetica,sans-serif;"><i>
</i></span><div style="text-align: justify;">
<span style="font-family: Arial,Helvetica,sans-serif;"><i>
And Guess what, in How much?</i></span></div>
<span style="font-family: Arial,Helvetica,sans-serif;"><i>
</i></span><div style="text-align: justify;">
<span style="font-family: Arial,Helvetica,sans-serif;"><i>
<br />
<script async src="//pagead2.googlesyndication.com/pagead/js/adsbygoogle.js"></script>

<ins class="adsbygoogle"
     style="display:block"
     data-ad-client="ca-pub-7726750987177406"
     data-ad-slot="7596682374"
     data-ad-format="auto"></ins>
<script>
(adsbygoogle = window.adsbygoogle || []).push({});
</script><br /></i></span></div>
<span style="font-family: Arial,Helvetica,sans-serif;"><i>
</i></span><div style="text-align: justify;">
<span style="font-family: Arial,Helvetica,sans-serif;"><i><b>$1,000,000. Yes, $1 Million.</b></i></span></div>
<div style="text-align: justify;">
<span style="font-family: Arial,Helvetica,sans-serif;"><i><b> </b></i></span></div>
<div class="separator" style="clear: both; text-align: center;">
<a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjExcA92xEmyzv-ZzP2vj_Os4L5C7tQpBBovqnIu_AT76Hlf6Db9LrWfuEx3mfHYxdQCV1VlhtB7LhlsixiwT35EPG4C_88kOkRnEzDbpdmchIhtWqdeGNS0O3ssf-2MZVA34xQh_kSMik/s1600/zerodium.png" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" height="366" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjExcA92xEmyzv-ZzP2vj_Os4L5C7tQpBBovqnIu_AT76Hlf6Db9LrWfuEx3mfHYxdQCV1VlhtB7LhlsixiwT35EPG4C_88kOkRnEzDbpdmchIhtWqdeGNS0O3ssf-2MZVA34xQh_kSMik/s640/zerodium.png" width="640" /></a></div>
<div style="text-align: justify;">
<span style="font-family: Arial,Helvetica,sans-serif;"><i><b><span class="main-article-info"><div style="text-align: justify;">
Last month, a <span style="font-weight: normal;">Bug bounty challenge
 was announced by Zerodium for finding a hack that must allow an 
attacker to remotely compromise a non-jailbroken Apple device through:</span></div>
<span style="font-weight: normal;">
</span><div style="text-align: justify;">
</div>
<span style="font-weight: normal;">
</span><ul>
<li><span style="font-weight: normal;">A web page on Safari or Chrome browser,</span></li>
<li><span style="font-weight: normal;">In-app browsing action, or</span></li>
<li><span style="font-weight: normal;">Text message or MMS.</span></li>
</ul>
</span></b></i></span><span style="font-family: Arial,Helvetica,sans-serif;"><i><b> </b><span class="main-article-info"><div style="text-align: justify;">
Zerodium's Founder Chaouki Bekrar<b> </b><a href="https://twitter.com/Zerodium/status/661240316331069443?ref_src=twsrc%5Etfw" rel="nofollow" target="_blank">confirmed</a> on Twitter that an unnamed group of hackers has won this $1 Million Bounty for sufficiently submitting a remote browser-based iOS 9.1/9.2b Jailbreak (untethered) Exploit.</div>
<div style="text-align: justify;">
</div>
<h3 style="text-align: justify;">
NO More Fun. It's Serious Threat to iOS Users</h3>
<div style="text-align: justify;">
</div>
<div style="text-align: justify;">
For those who are not aware, this remote Jailbreak is not really cool.</div>
<div style="text-align: justify;">
</div>
<div style="text-align: justify;">
Why? Because…</div>
<div style="text-align: justify;">
</div>
<div class="separator" style="clear: both; text-align: center;">
<a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhhU2tB1-kWfyAqObo02LMIAMUl-cDOKgTCPvxx0MzHLMYH5y9ijdsCI_WwciOJsFh2yzTY_Y1_CtvtijAmPnQ37MtvPr6_vJDgJuyaiizafA_t1vhbbvPfO4UAPOICt5tMCOyXfjPW76g/s1600/Zerodium-channelbiz.es_.jpg" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" height="227" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhhU2tB1-kWfyAqObo02LMIAMUl-cDOKgTCPvxx0MzHLMYH5y9ijdsCI_WwciOJsFh2yzTY_Y1_CtvtijAmPnQ37MtvPr6_vJDgJuyaiizafA_t1vhbbvPfO4UAPOICt5tMCOyXfjPW76g/s400/Zerodium-channelbiz.es_.jpg" width="400" /></a></div>
<div style="text-align: justify;">
The only difference between a malicious cyber attack and Jailbreak is – <b>Payload</b>, the code that executes on target system after exploitation.</div>
<div style="text-align: justify;">
<br />
<script async src="//pagead2.googlesyndication.com/pagead/js/adsbygoogle.js"></script>

<ins class="adsbygoogle"
     style="display:block"
     data-ad-client="ca-pub-7726750987177406"
     data-ad-slot="7596682374"
     data-ad-format="auto"></ins>
<script>
(adsbygoogle = window.adsbygoogle || []).push({});
</script>
<br />
</div>
<div style="text-align: justify;">
A traditional jailbreak process is usually used to deploy an alternative
 App Store, but in hands of Hackers or law enforcement agencies, the 
same exploit can allow them to install any app they want with full 
privileges i.e. <b>Spyware</b>, <b>Malware</b> or <b>Surveillance software</b>.</div>
<div style="text-align: justify;">
</div>
<div style="text-align: justify;">
Moreover, We know that Zerodium's parent company Vupen develops hacking 
techniques based on those bugs and typically sells them to multiple 
government customers.</div>
</span></i></span><span style="font-family: Arial,Helvetica,sans-serif;"><i><span class="main-article-info">So, 
the chances are high that the firm will resell the newly discovered and 
undisclosed remote iOS zero-day jailbreak exploit to its clients, which 
are said to include Spy agencies, Governments, and Law enforcement 
agencies.</span></i></span></div>
</div>

Hacking news ios9 Latest News Security news Vulnerabilities Hackers WIN $1 Million Bounty for Remotely Hacking latest iOS 9 iPhone

Well, here's some terrible news for all Apple iOS users… Someone just found an iOS zero-day vulnerability that could allo...

Recently Exploited Flash Zero-Day Added to Exploit Kits

10:04 PM Unknown 0

<div dir="ltr" style="text-align: left;" trbidi="on">
<div class="separator" style="clear: both; text-align: center;">
<a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhjrqVwu3U8Ip-FU1MRuExH9pjejSA69HO5td8ynxEtPmiPta7Ot6aIbDWf0Bxc3L1JTN3vKsDMxbFjDIHj97E2Sy4zXgnAfE5phNMFLTj5WEgYSHgyINm_z-pVn6orqE6iglVHeh43Z2g/s1600/Angler-Exploit-Kit-%2528EK%2529-and-Nuclear-EK%252C-anti-malware-firm-Malwarebytes-reported..jpg" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" height="458" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhjrqVwu3U8Ip-FU1MRuExH9pjejSA69HO5td8ynxEtPmiPta7Ot6aIbDWf0Bxc3L1JTN3vKsDMxbFjDIHj97E2Sy4zXgnAfE5phNMFLTj5WEgYSHgyINm_z-pVn6orqE6iglVHeh43Z2g/s640/Angler-Exploit-Kit-%2528EK%2529-and-Nuclear-EK%252C-anti-malware-firm-Malwarebytes-reported..jpg" width="640" /></a></div>
<br />
<div class="MsoNormal" style="background-color: white; color: #333333; font-family: Verdana, Arial, Helvetica, sans-serif; font-size: 12px; line-height: 20px;">
<span style="font-size: small;"><span style="font-family: 'trebuchet ms', geneva;"><strong>The recently discovered CVE-2015-7645 zero-day vulnerability in Adobe Flash Player has been already added to Angler Exploit Kit (EK) and Nuclear EK, anti-malware firm Malwarebytes <a href="https://blog.malwarebytes.org/exploits-2/2015/10/recent-flash-zero-day-now-part-of-exploit-kits/" style="color: #0076b4; text-decoration: none;" target="_blank">reported</a>.</strong></span></span></div>
<div class="MsoNormal" style="background-color: white; color: #333333; font-family: Verdana, Arial, Helvetica, sans-serif; font-size: 12px; line-height: 20px;">
<span style="font-size: small;"><span style="font-family: 'trebuchet ms', geneva;"><strong><br /></strong></span></span></div>
<div class="MsoNormal" style="background-color: white; color: #333333; font-family: Verdana, Arial, Helvetica, sans-serif; font-size: 12px; line-height: 20px;">
<span style="font-size: small;"><span style="font-family: 'trebuchet ms', geneva;"><strong></strong></span></span><span style="font-family: 'trebuchet ms', geneva; font-size: small;">The security flaw was discovered in mid-October, when it was found being </span>exploited<span style="font-family: 'trebuchet ms', geneva; font-size: small;"> by the Russia-linked Pawn Storm threat group in attacks aimed at Foreign Affairs Ministries. </span></div>
<div class="MsoNormal" style="background-color: white; color: #333333; font-family: Verdana, Arial, Helvetica, sans-serif; font-size: 12px; line-height: 20px;">
<span style="font-family: 'trebuchet ms', geneva; font-size: small;"><br /></span></div>
<div class="MsoNormal" style="background-color: white; color: #333333; font-family: Verdana, Arial, Helvetica, sans-serif; font-size: 12px; line-height: 20px;">
<span style="font-family: 'trebuchet ms', geneva; font-size: small;">The vulnerability affects all Flash releases up to version 19.0.0.226 for Mac and Windows, and Flash Player 11.2.202.540 for Linux, and was discovered by researchers at Trend Micro.</span></div>
<div class="MsoNormal" style="background-color: white; color: #333333; font-family: Verdana, Arial, Helvetica, sans-serif; font-size: 12px; line-height: 20px;">
<span style="font-size: small;"><span style="font-family: 'trebuchet ms', geneva;">Adobe patched the vulnerability one week after the attacks were discovered, when it also resolved CVE-2015-7647 and CVE-2015-7648 vulnerabilities that could result in arbitrary code execution. The Pawn Storm group exploited the CVE-2015-7645 zero-day through luring victims (employees of Foreign Affairs Ministries from around the world) to websites containing the Flash Player exploit by means of spear-phishing emails.</span></span></div>
<div class="MsoNormal" style="background-color: white; color: #333333; font-family: Verdana, Arial, Helvetica, sans-serif; font-size: 12px; line-height: 20px;">
<span style="font-size: small;"><span style="font-family: 'trebuchet ms', geneva;">The inclusion of this zero-day in Angler EK and Nuclear EK renders Flash users even more vulnerable to different types of attacks, especially if they do not keep the Web browser plugin updated. </span></span></div>
<div style="background-color: white; color: #333333; font-family: Verdana, Arial, Helvetica, sans-serif; font-size: 12px; line-height: 20px;">
</div>
<div class="MsoNormal" style="background-color: white; color: #333333; font-family: Verdana, Arial, Helvetica, sans-serif; font-size: 12px; line-height: 20px;">
<span style="font-size: small;"><span style="font-family: 'trebuchet ms', geneva;">The developers of exploit kits are aggressive in integrating newly discovered vulnerabilities into their malicious programs, and it usually takes them only a couple of weeks to do so. In August, the developers of the Angler exploit kit added support for an Internet Explorer vulnerability just weeks after it was patched by Microsoft. In May, a memory corruption flaw in Flash version prior to 17.0.0.188 was added to Angler EK only two weeks after it was patched, and it was added to Magnitude, Neutrino, and Nuclear Pack EKs as well only a few days later.</span></span></div>
</div><br>
<script async src="//pagead2.googlesyndication.com/pagead/js/adsbygoogle.js"></script>

<ins class="adsbygoogle"
     style="display:block"
     data-ad-client="ca-pub-7726750987177406"
     data-ad-slot="7596682374"
     data-ad-format="auto"></ins>
<script>
(adsbygoogle = window.adsbygoogle || []).push({});
</script>
<br>

Hacking news Latest News Security news Recently Exploited Flash Zero-Day Added to Exploit Kits

The recently discovered CVE-2015-7645 zero-day vulnerability in Adobe Flash Player has been already added to Angler Exploit Kit (EK) an...

Flaw in SAP Firm's XSS Filter Exposed Many Sites to Attacks

9:55 PM Unknown 0

<div dir="ltr" style="text-align: left;" trbidi="on">
<div class="separator" style="clear: both; text-align: center;">
<a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgc-ABeEfVK9yAbS0gOECavp8dD9pzXk8l7dR728UDDfyYm0bMnSudPQsyVKAvUgUJiHiWalMmc3EyCTVqpMkRn3b9JWPT5TunW8QBGFiTq4w9UD-3B6pGy70a2WvC4L7tioKBVEWGEsvo/s1600/image-59545-panoV9free-pcqg-59545.jpg" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" height="306" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgc-ABeEfVK9yAbS0gOECavp8dD9pzXk8l7dR728UDDfyYm0bMnSudPQsyVKAvUgUJiHiWalMmc3EyCTVqpMkRn3b9JWPT5TunW8QBGFiTq4w9UD-3B6pGy70a2WvC4L7tioKBVEWGEsvo/s640/image-59545-panoV9free-pcqg-59545.jpg" width="640" /></a></div>
<br />
<br />
<div style="background-color: white; color: #333333; font-family: Verdana, Arial, Helvetica, sans-serif; font-size: 12px; line-height: 20px;">
<strong><span style="font-size: small;"><span style="font-family: 'trebuchet ms', geneva;">Roughly one hundred websites were exposed to cross-site scripting (XSS) attacks because an XSS filter used on some of their web pages could have been easily bypassed, a researcher reported on Sunday.</span></span></strong></div>
<div style="background-color: white; color: #333333; font-family: Verdana, Arial, Helvetica, sans-serif; font-size: 12px; line-height: 20px;">
<strong><span style="font-size: small;"><span style="font-family: 'trebuchet ms', geneva;"><br /></span></span></strong></div>
<div style="background-color: white; color: #333333; font-family: Verdana, Arial, Helvetica, sans-serif; font-size: 12px; line-height: 20px;">
<span style="font-size: small;"><span style="font-family: 'trebuchet ms', geneva;">Ashar Javed, a security researcher who specializes in finding tricky XSS vulnerabilities,<a href="https://respectxss.blogspot.de/2015/11/a-tale-of-breaking-saps-successfactorss.html" style="color: #0076b4; font-weight: bold; text-decoration: none;" target="_blank">identified a reflected XSS flaw</a> on a website used by Germany-based enterprise software maker SAP to list jobs available within the company.</span></span></div>
<div style="background-color: white; color: #333333; font-family: Verdana, Arial, Helvetica, sans-serif; font-size: 12px; line-height: 20px;">
<span style="font-size: small;"><span style="font-family: 'trebuchet ms', geneva;">While the affected page was protected by an XSS filter to prevent attacks, the expert discovered that developers had failed to escape certain strings, such as <em><span style="color: red;"></</span></em> and <span style="color: red;"><em>'</em></span>, when sanitizing user input. This oversight could have allowed attackers to inject specially crafted XSS payloads into the website.</span></span></div>
<div style="background-color: white; color: #333333; font-family: Verdana, Arial, Helvetica, sans-serif; font-size: 12px; line-height: 20px;">
<span style="font-size: small;"><span style="font-family: 'trebuchet ms', geneva;"><br /></span></span></div>
<div style="background-color: white; color: #333333; font-family: Verdana, Arial, Helvetica, sans-serif; font-size: 12px; line-height: 20px;">
<span style="font-size: small;"><span style="font-family: 'trebuchet ms', geneva;">After conducting some tests, Javed discovered that <em><span style="color: red;"></</span></em> could not be used for XSS attacks since the "<span style="color: black;"></script><em>"</em></span> string was blocked, but the single quotation mark had been used by developers for “if” conditions, allowing the use of XSS payloads such as <em><span style="color: red;">‘-confirm(1)-’</span></em>.</span></span></div>
<div style="background-color: white; color: #333333; font-family: Verdana, Arial, Helvetica, sans-serif; font-size: 12px; line-height: 20px;">
<span style="font-size: small;"><span style="font-family: 'trebuchet ms', geneva;">In this example, the JavaScript “confirm” function is used to display a dialog box containing the message “1” along with OK and Cancel buttons. However, the expert told <em>SecurityWeek</em>that other functions could have been used as well.</span></span></div>
<div style="background-color: white; color: #333333; font-family: Verdana, Arial, Helvetica, sans-serif; font-size: 12px; line-height: 20px;">
<span style="font-size: small;"><span style="font-family: 'trebuchet ms', geneva;">After reporting his findings to SAP at the software giant’s Product Security Expert Summit in March, Javed learned that the flawed XSS filter belongs to SuccessFactors, a SAP-owned company that provides cloud-based human capital management solutions.</span></span></div>
<div style="background-color: white; color: #333333; font-family: Verdana, Arial, Helvetica, sans-serif; font-size: 12px; line-height: 20px;">
<span style="font-size: small;"><span style="font-family: 'trebuchet ms', geneva;">The expert identified the buggy XSS filter on roughly 100 websites, many of which belong to high profile companies. Javed believes the filter is part of SuccessFactors’ product, which is also suggested by the fact that the vulnerable component is present on the jobs/careers domains of the impacted sites.</span></span></div>
<div style="background-color: white; color: #333333; font-family: Verdana, Arial, Helvetica, sans-serif; font-size: 12px; line-height: 20px;">
<span style="font-size: small;"><span style="font-family: 'trebuchet ms', geneva;"><br /></span></span></div>
<div style="background-color: white; color: #333333; font-family: Verdana, Arial, Helvetica, sans-serif; font-size: 12px; line-height: 20px;">
<span style="font-size: small;"><span style="font-family: 'trebuchet ms', geneva;">The vulnerability was addressed roughly three months after it was reported to SAP. The company <a href="http://scn.sap.com/docs/DOC-55451" style="color: #0076b4; font-weight: bold; text-decoration: none;" target="_blank">acknowledged</a> the security researcher’s work in July.</span></span></div>
<div style="background-color: white; color: #333333; font-family: Verdana, Arial, Helvetica, sans-serif; font-size: 12px; line-height: 20px;">
<span style="font-size: small;"><span style="font-family: 'trebuchet ms', geneva;">Javed says he has also identified a series of flaws in SAP Enterprise Portal, which he plans on disclosing after they are resolved by the vendor.</span></span></div>
<div style="background-color: white; color: #333333; font-family: Verdana, Arial, Helvetica, sans-serif; font-size: 12px; line-height: 20px;">
<span style="font-size: small;"><span style="font-family: 'trebuchet ms', geneva;">Last month, the researcher reported finding an XSS vulnerability in YouTube Gaming, a gaming-focused video website launched this summer by YouTube. The expert reported his findings to Google and was awarded more than $3,000 for his work.</span></span></div>
</div>
<br>
<script async src="//pagead2.googlesyndication.com/pagead/js/adsbygoogle.js"></script>

<ins class="adsbygoogle"
     style="display:block"
     data-ad-client="ca-pub-7726750987177406"
     data-ad-slot="7596682374"
     data-ad-format="auto"></ins>
<script>
(adsbygoogle = window.adsbygoogle || []).push({});
</script>
<br>

Cyber Crime Hacker Hacking news Latest News Security news Flaw in SAP Firm's XSS Filter Exposed Many Sites to Attacks

Roughly one hundred websites were exposed to cross-site scripting (XSS) attacks because an XSS filter used on some of their web pages ...

Britain to Unveil New Online Spying Laws

9:14 PM Unknown 0

<div dir="ltr" style="text-align: left;" trbidi="on">
<div style="background-color: white; color: #333333; font-family: Verdana, Arial, Helvetica, sans-serif; font-size: 12px; line-height: 20px;">
<span style="font-size: small;"><span style="font-family: 'trebuchet ms', geneva;"><strong><br /></strong></span></span></div>
<div class="separator" style="clear: both; text-align: center;">
<a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhi3zjAzFm6XYPGxGC03pM2ZN4unYI5nVWdUMG6rj97NKSZH4QdTcnuEdDotCbE-DsD6GQmnBQkdFZm-kiDVChyphenhyphenGfHqBwjtgiFVIumfTH6Q980wzXeq2-GebbpcAUkKsHMxbhHiixFeQGA/s1600/The-day-I-discovered-the-Harper-Government-is-spying-on-me.jpg" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" height="404" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhi3zjAzFm6XYPGxGC03pM2ZN4unYI5nVWdUMG6rj97NKSZH4QdTcnuEdDotCbE-DsD6GQmnBQkdFZm-kiDVChyphenhyphenGfHqBwjtgiFVIumfTH6Q980wzXeq2-GebbpcAUkKsHMxbhHiixFeQGA/s640/The-day-I-discovered-the-Harper-Government-is-spying-on-me.jpg" width="640" /></a></div>
<div style="background-color: white; color: #333333; font-family: Verdana, Arial, Helvetica, sans-serif; font-size: 12px; line-height: 20px;">
<span style="font-size: small;"><span style="font-family: 'trebuchet ms', geneva;"><strong><br /></strong></span></span></div>
<div style="background-color: white; color: #333333; font-family: Verdana, Arial, Helvetica, sans-serif; font-size: 12px; line-height: 20px;">
<span style="font-size: small;"><span style="font-family: 'trebuchet ms', geneva;"><strong><br /></strong></span></span></div>
<div style="background-color: white; color: #333333; font-family: Verdana, Arial, Helvetica, sans-serif; font-size: 12px; line-height: 20px;">
<span style="font-size: small;"><span style="font-family: 'trebuchet ms', geneva;"><strong>Britain's government gave the first details Sunday of contested plans to update Internet spying laws to keep pace with the digital age.</strong></span></span></div>
<div style="background-color: white; color: #333333; font-family: Verdana, Arial, Helvetica, sans-serif; font-size: 12px; line-height: 20px;">
<span style="font-size: small;"><span style="font-family: 'trebuchet ms', geneva;"><strong><br /></strong></span></span></div>
<div style="background-color: white; color: #333333; font-family: Verdana, Arial, Helvetica, sans-serif; font-size: 12px; line-height: 20px;">
<span style="font-size: small;"><span style="font-family: 'trebuchet ms', geneva;">The proposed law comes as intelligence agencies and police grapple with monitoring terrorist activity online amid a debate sparked by Edward Snowden over government access to personal data online.</span></span></div>
<div style="background-color: white; color: #333333; font-family: Verdana, Arial, Helvetica, sans-serif; font-size: 12px; line-height: 20px;">
<span style="font-size: small;"><span style="font-family: 'trebuchet ms', geneva;">Home Secretary Theresa May told the BBC that the measures would not ban encryption and "will not be giving powers to go through people's browsing history".</span></span></div>
<div style="background-color: white; color: #333333; font-family: Verdana, Arial, Helvetica, sans-serif; font-size: 12px; line-height: 20px;">
<span style="font-size: small;"><span style="font-family: 'trebuchet ms', geneva;">However, the authorities will be able to look at Internet and social media activity if they get a special warrant.</span></span></div>
<div style="background-color: white; color: #333333; font-family: Verdana, Arial, Helvetica, sans-serif; font-size: 12px; line-height: 20px;">
<span style="font-size: small;"><span style="font-family: 'trebuchet ms', geneva;">Such warrants are currently issued by May but this authority could be handed to judges under the new measures.</span></span></div>
<div style="background-color: white; color: #333333; font-family: Verdana, Arial, Helvetica, sans-serif; font-size: 12px; line-height: 20px;">
<span style="font-size: small;"><span style="font-family: 'trebuchet ms', geneva;">Technology companies will reportedly have to keep records of emails and people's use of social media sites like WhatsApp and Facebook for 12 months and authorities will be able to access this with a second warrant.</span></span></div>
<div style="background-color: white; color: #333333; font-family: Verdana, Arial, Helvetica, sans-serif; font-size: 12px; line-height: 20px;">
<span style="font-size: small;"><span style="font-family: 'trebuchet ms', geneva;">The disclosures came ahead of Wednesday's release of the draft Investigatory Powers Bill.</span></span></div>
<div style="background-color: white; color: #333333; font-family: Verdana, Arial, Helvetica, sans-serif; font-size: 12px; line-height: 20px;">
<span style="font-size: small;"><span style="font-family: 'trebuchet ms', geneva;">It will be scrutinized by a committee of lawmakers, allowing changes to be made before it is formally debated by parliament.</span></span></div>
<div style="background-color: white; color: #333333; font-family: Verdana, Arial, Helvetica, sans-serif; font-size: 12px; line-height: 20px;">
<span style="font-size: small;"><span style="font-family: 'trebuchet ms', geneva;">Britain's intelligence chiefs have issued a string of warnings in recent months about the dangers posed by terrorist organizations recruiting and planning  attacks online.</span></span></div>
<div style="background-color: white; color: #333333; font-family: Verdana, Arial, Helvetica, sans-serif; font-size: 12px; line-height: 20px;">
<span style="font-size: small;"><span style="font-family: 'trebuchet ms', geneva;">In a rare public speech last week, the head of domestic spying agency MI5 Andrew Parker said Britain was under threat "on a scale and at a tempo that I have not seen before".</span></span></div>
<div style="background-color: white; color: #333333; font-family: Verdana, Arial, Helvetica, sans-serif; font-size: 12px; line-height: 20px;">
<span style="font-size: small;"><span style="font-family: 'trebuchet ms', geneva;">He highlighted the Islamic State (IS) group's "sophisticated exploitation of technology" through "the full range of modern communications tools to spread its message of hate and to inspire extremists".</span></span></div>
<div style="background-color: white; color: #333333; font-family: Verdana, Arial, Helvetica, sans-serif; font-size: 12px; line-height: 20px;">
<span style="font-size: small;"><span style="font-family: 'trebuchet ms', geneva;">The previous coalition government led by Prime Minister David Cameron wanted to pass a law covering similar issues, dubbed a "snoopers' charter" by critics, but was blocked by junior coalition partners the Liberal Democrats as too intrusive.</span></span></div>
<div style="background-color: white; color: #333333; font-family: Verdana, Arial, Helvetica, sans-serif; font-size: 12px; line-height: 20px;">
<span style="font-size: small;"><span style="font-family: 'trebuchet ms', geneva;">Since winning May's general election outright though with a small majority, Cameron has more room for maneuver but is still likely to face opposition from some in his Conservative party over the measures.</span></span></div>
</div>
<br>
<script async src="//pagead2.googlesyndication.com/pagead/js/adsbygoogle.js"></script>

<ins class="adsbygoogle"
     style="display:block"
     data-ad-client="ca-pub-7726750987177406"
     data-ad-slot="7596682374"
     data-ad-format="auto"></ins>
<script>
(adsbygoogle = window.adsbygoogle || []).push({});
</script>
<br>

Cyber Crime Hacking news Security news Britain to Unveil New Online Spying Laws

Britain's government gave the first details Sunday of contested plans to update Internet spying laws to keep pace with the dig...

New Types of Reflection DDoS Attacks Spotted

11:20 PM Unknown 0

<div dir="ltr" style="text-align: left;" trbidi="on">
<div dir="ltr" style="text-align: left;" trbidi="on">
<div class="separator" style="clear: both; text-align: center;">
<a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgs4CrnwVRdpgKmsZqr78IomhkK0anpWQfuZ8ZO2L8ypabDIC6I3cwU_ooJQ2NjD64lZwXJp2kVVccPGReTLORORUzOJR2P58uwNZdgTqwrQNFk1dhK2SQjAK4XcaSge3HNnty5jBY_WMM/s1600/DDoS11.jpg" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" height="303" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgs4CrnwVRdpgKmsZqr78IomhkK0anpWQfuZ8ZO2L8ypabDIC6I3cwU_ooJQ2NjD64lZwXJp2kVVccPGReTLORORUzOJR2P58uwNZdgTqwrQNFk1dhK2SQjAK4XcaSge3HNnty5jBY_WMM/s400/DDoS11.jpg" width="400" /></a></div>
<br />
<br />
<br />
<br />
<div style="background-color: white; color: #333333; font-family: Verdana, Arial, Helvetica, sans-serif; font-size: 12px; line-height: 20px;">
<strong><span style="font-size: small;"><span style="font-family: 'trebuchet ms', geneva;">A new threat advisory published this week by Akamai’s Security Intelligence Response Team warns organizations about three new types of reflection distributed denial-of-service (DDoS) attacks observed in recent months.</span></span></strong></div>
<div style="background-color: white; color: #333333; font-family: Verdana, Arial, Helvetica, sans-serif; font-size: 12px; line-height: 20px;">
<strong><span style="font-size: small;"><span style="font-family: 'trebuchet ms', geneva;"><br /></span></span></strong></div>
<div style="background-color: white; color: #333333; font-family: Verdana, Arial, Helvetica, sans-serif; font-size: 12px; line-height: 20px;">
<strong><span style="font-size: small;"><span style="font-family: 'trebuchet ms', geneva;"><br /></span></span></strong></div>
<div style="background-color: white; color: #333333; font-family: Verdana, Arial, Helvetica, sans-serif; font-size: 12px; line-height: 20px;">
<span style="font-size: small;"><span style="font-family: 'trebuchet ms', geneva;">There are well over a dozen <a href="https://www.us-cert.gov/ncas/alerts/TA14-017A" style="color: #0076b4; font-weight: bold; text-decoration: none;" target="_blank">UDP protocols</a> that can be abused for the reflection and amplification of DDoS attacks, including DNS, NTP, SSDP, BitTorrent, RIPv1, mDNS, CharGEN, QOTD, NetBIOS, and Portmap. While some of these services have been abused for a long time, others are not as popular among attackers.</span></span></div>
<div style="background-color: white; color: #333333; font-family: Verdana, Arial, Helvetica, sans-serif; font-size: 12px; line-height: 20px;">
<span style="font-size: small;"><span style="font-family: 'trebuchet ms', geneva;"><br /></span></span></div>
<div style="background-color: white; color: #333333; font-family: Verdana, Arial, Helvetica, sans-serif; font-size: 12px; line-height: 20px;">
<span style="font-size: small;"><span style="font-family: 'trebuchet ms', geneva;">According to Akamai, attackers have recently started abusing the RPC portmap service, NetBIOS name servers, and Sentinel licensing servers.</span></span></div>
<div style="background-color: white; color: #333333; font-family: Verdana, Arial, Helvetica, sans-serif; font-size: 12px; line-height: 20px;">
<span style="font-size: small;"><span style="font-family: 'trebuchet ms', geneva;">The content delivery network (CDN) service provider reported spotting attacks leveraging NetBIOS, a service used by applications on separate computers to communicate over a LAN, sporadically between March and July 2015. In the attacks observed by the company, the attackers obtained amplification rates ranging between 2.56 and 3.85. Of the four attacks seen by Akamai, the largest peaked at 15.7 Gbps.</span></span></div>
<div style="background-color: white; color: #333333; font-family: Verdana, Arial, Helvetica, sans-serif; font-size: 12px; line-height: 20px;">
<span style="font-size: small;"><span style="font-family: 'trebuchet ms', geneva;">Another uncommon type of reflection attack spotted over the past period by the CDN company abused RPC Portmap (Portmapper), an Open Network Computing Remote Procedure Call (ONC RPC) service designed to map RPC service numbers to network port numbers.</span></span></div>
<div style="background-color: white; color: #333333; font-family: Verdana, Arial, Helvetica, sans-serif; font-size: 12px; line-height: 20px;">
<span style="font-size: small;"><span style="font-family: 'trebuchet ms', geneva;">These types of attacks are much more powerful than the ones leveraging NetBIOS, with the largest attack exceeding 100 Gbps. While the most common amplification factor observed by Akamai was approximately 10, experts noticed one instance where the traffic sent to the targeted server was multiplied more than 50 times.</span></span></div>
<div style="background-color: white; color: #333333; font-family: Verdana, Arial, Helvetica, sans-serif; font-size: 12px; line-height: 20px;">
<span style="font-size: small;"><span style="font-family: 'trebuchet ms', geneva;">Akamai said it had observed such attacks almost every day in September. In August, when the company noticed the first RPC Portmap reflection attacks, telecoms firm Level 3 Communications also warned organizations about such threats.</span></span></div>
<div style="background-color: white; color: #333333; font-family: Verdana, Arial, Helvetica, sans-serif; font-size: 12px; line-height: 20px;">
<span style="font-size: small;"><span style="font-family: 'trebuchet ms', geneva;">Another type of attack abuses Sentinel license servers, which are used to enforce and manage licensing in multi-user environments. The first such attack was observed by Akamai in June 2015 and it leveraged a vulnerable Sentinel server used by Stockholm University in Sweden. In September, Akamai mitigated a couple of Sentinel reflection DDoS attacks aimed at a gaming company and a financial firm, with a peak bandwidth of 11.7 Gbps detected for one of these attacks. DDoS protection company <a href="http://www.prnewswire.com/news-releases/nexusguard-finds-new-reflective-denial-of-service-threat----sentinel-attack-can-compromise-over-92000-vulnerable-global-machines-300147901.html" style="color: #0076b4; font-weight: bold; text-decoration: none;" target="_blank">Nexusguard</a> also warned about such attacks last month.</span></span></div>
<div style="background-color: white; color: #333333; font-family: Verdana, Arial, Helvetica, sans-serif; font-size: 12px; line-height: 20px;">
<span style="font-size: small;"><span style="font-family: 'trebuchet ms', geneva;">While the amplification factor for such attacks can exceed 40, attackers are limited by the fact that there aren’t many Sentinel servers that can be abused. Only 745 unique sources of attack traffic have been identified, Akamai said in its <a href="https://www.stateoftheinternet.com/downloads/pdfs/2015-state-of-the-internet-threat-advisory-ddos-reflection-netbios-name-server-rpc-portmap-sentinel-udp-ddos-attacks.pdf" style="color: #0076b4; font-weight: bold; text-decoration: none;" target="_blank">report</a>. </span></span></div>
<div style="background-color: white; color: #333333; font-family: Verdana, Arial, Helvetica, sans-serif; font-size: 12px; line-height: 20px;">
<span style="font-size: small;"><span style="font-family: 'trebuchet ms', geneva;">"Although reflection DDoS attacks are common, these three attack vectors abuse different services than we've seen before, and as such they demonstrate that attackers are probing the Internet relentlessly to discover new resources to leverage," said Stuart Scholly, senior vice president and general manager at Akamai’s Security Business Unit. "It looks like no UDP service is safe from abuse by DDoS attackers, so server admins need to shut down unnecessary services or protect them from malicious reflection. The sheer volume of UDP services open to the Internet for reflection DDoS attacks is staggering."</span></span></div>
<div style="background-color: white; color: #333333; font-family: Verdana, Arial, Helvetica, sans-serif; font-size: 12px; line-height: 20px;">
<span style="font-size: small;"><span style="font-family: 'trebuchet ms', geneva;">Earlier this week, Symantec warned that attackers had started abusing MySQL servers infected with a piece of malware dubbed “Chikdos” for DDoS attacks.</span></span></div>
</div>
<br />
<script async="" src="//pagead2.googlesyndication.com/pagead/js/adsbygoogle.js"></script>

<br />
<ins class="adsbygoogle" data-ad-client="ca-pub-7726750987177406" data-ad-format="auto" data-ad-slot="7596682374" style="display: block;"></ins><script>
(adsbygoogle = window.adsbygoogle || []).push({});
</script>
</div>

DDoS Hacker Hacking news Latest News Security news New Types of Reflection DDoS Attacks Spotted

A new threat advisory published this week by Akamai’s Security Intelligence Response Team warns organizations about three new types...

Latest Hacking News And Events - dA1337