Showing posts with label Cyber Attacks. Show all posts
Showing posts with label Cyber Attacks. Show all posts
The Co-Founder of Pirate Bay "Gottfrid Svartholm Warg" (Anakata) was found Guilty in Denmark's Largest Hacking Case
The Pirate Bay
The co-founder of The Pirate Bay torrent site Gottfrid Svartholm Warg and his 21-year-old Danish co-defendant have been found guilty by a Danish court of hacking into systems operated by American IT giant CSC and illegally downloading files. It was the biggest hacking case ever conducted in the history of Denmark.
By breaking into the servers maintained by CSC, Svartholm Warg illegally accessed police email accounts and stolen email addresses and passwords of over 10,000 policemen, explored the European border control database, and downloaded millions of social security numbers belonging to Danish citizens. The initial hack attack took place for about six months.
"This is the largest hacking case to date. The crime is very serious, and this must be reflected in the sentence," Prosecutor Maria Cingali said.
Gottfrid Svartholm allegedly committed the crime along with his his 21-year-old co-defendant between February and August 2012. His co-defendant is only known by the alias of "JKT" as the Judge Kari Sørensen, who presided over the case, ordered media outlets not to publish his name in order to protect the man’s privacy.
The defence team argued that although the hack attacks were carried out using a computer owned by Svartholm, but he was not the person that used it to steal the files as, they said, his entire group of developers had access to the computer. So, any one of them could be responsible for the hacking.
"My recommendation has always been that the investigation has focused on finding clues that point to my client, even though the tracks have also pointed in another direction," lawyer Louise Høj said, as cited by TorrentFreak. "It is clear that my client’s computer has been the subject of remote control, and therefore he is not responsible."
However, the court said the unauthorized access to CSC computer mainframes was a "systematic and organised" approach, dismissing the Swede’s claims that his computer system was used by someone else to carry out the hack as "unlikely," the Local reports.
Security expert Jacob Appelbaum, a well-known activist and leading member of the Tor project - an open source and free anonymous browser service, said that it would have been easy for an outsider to gain access to Warg’s computer. He pointed out that Danish authorities had found no forensic evidence and all of the evidence had been provided by CSC.
Appelbaum expressed his disappointment with the conviction on Twitter. "Gottfrid convicted. I'm sad to hear that only two of the jurors understand the technology involved," Appelbaum tweeted yesterday.
Gottfrid Svartholm was arrested in his Cambodian apartment in September 2012 and it took two years before he went on trial in Denmark. In September 2013, he was deported from Cambodia to Sweden where he served a jail term for copyright theft because of his involvement with the Pirate Bay file-sharing site.
In a separate trial in 2013, Warg was sentenced to one year in a Swedish jail for hacking into a bank's computers. Then in November 2013, he was finally extradited to Denmark to face charges in the CSC hacking cases.
Svartholm will be sentenced on 31 October and could face six years in jail. His accomplice walked free from the court on Thursday as he had served 17 months in pre-trial detention.
"The punishment should be close to the maximum punishment, which can be six years in prison," the senior prosecutor in the case, Maria Cingari, said according to local media. "It shouldn’t be under five years."
Since its launch in 2003, The Pirate Bay (TPB) becomes the world's largest torrent tracker site which handles requests from millions of users everyday and is in the top 100 most visited websites on the Internet. TPB is predominantly used to share copyrighted material such as films, TV shows and music files, free of charge. Generally, it is famous for potentially hosting illegal contents on the website.Pirate bay is the world's largest torrent site, let us see if it still going to work.
Your Android Phone is Spying On You, Use custom ROM To Protect your Privacy
In this digital age, privacy is more important than ever. Just because you “don’t have anything to hide,” does not mean that you shouldn’t value your privacy or fight for it when companies do things like this, especially with something as personal as your cell phone.
An Android developer recently discovered a clandestine application called Carrier IQ built into most smartphones that doesn't just track your location; it secretly records your keystrokes, and there's nothing you can do about it. Is it time to put on a tinfoil hat? That depends on how you feel about privacy. In the nearly 20-minute video clip, Eckhart shows how software developed by mobile-device tracker Carrier IQ logs each keystroke and then sends them off to locations unknown. In addition, when Eckhart tried placing a call, Carrier IQ's software recorded each number before the call was even made.
What is Carrier IQ, exactly?
The software is hidden inside phones there is little you can do to detect that it’s even installed, let alone remove it, and it tracks everything. Keystrokes, browsing and surfing habits, Google searches, and basically every single thing that you are doing on your phone and every button that you press is logged by this software. Jump to 9:00 in the YouTube video below for the proof this is basically a keylogger running on your phone that you didn’t know about.
The company that’s creating this software claims that the point of the software is to deliver “analytics” about devices to the carriers to help them provide better service to their users. But is recording every keystroke really necessary for that information? Does not telling the users about this and making it near-impossible to opt out seem a bit fishy to anybody else? This software is on almost all Android phones made by the big names (HTC, Samsung, Motorola), and is even on BlackBerries and Nokia devices, as well.
"Our action was misguided and we are deeply sorry for any concern or trouble that our letter may have caused Mr. Eckhart," the company said in response to the EFF's letter. "We sincerely appreciate and respect EFF's work on his behalf, and share their commitment to protecting free speech in a rapidly changing technological world."
But Eckhart's new video seems to refute at least some of those claims. In one part of the clip, he shows how an entire SMS message--"hello world"--was recorded by Carrier IQ's software. In another example, he demonstrates how a Google search, his location, and other key information is recorded by Carrier IQ's application, even though he was on Wi-Fi and a page secured by HTTPS.
HTTPS? Nothing Is Safe From Carrier IQ
For those unaware, the S in HTTPS stands for secure. It's what keep your passwords and other sensitive data safe when sent across the web. It's provides encryption for said information, so whilst it's traveling through the airwaves, it's safe and snuggly, away from the awful people who want to steal your info.
Just because a website is using a secure connection doesn't mean it's one-hundred percent safe from end-to-end, though. You see, some information, including usernames and passwords, can still be sent plain text. For example, the username and password can be used in the address of the site, like www.mysite.com?username=MYNAME&password=MYPASS (Trev's example). Sure, it's encrypted while going down the tunnel, but guess who gets to see the raw link? Did you guess Carrier IQ? If so, go get yourself a cookie. You earned it. [Source]
Carrier IQ says in this public statement that it is “not logging keystrokes or providing tracking tools” and that its software is used to track performance, but the video proves entirely otherwise: this app is sitting in between you and the Android OS and is making a note of everything you do. Secure websites don’t help. Even using Wi-Fi doesn’t help. Your phone use is being logged by this software, and there is no way to easily opt out.
Devices Without a Cellular Network Aren't Safe, Either
Let's think about the name of this thing for a minute - Carrier IQ. So, it's probably safe to say that this is all about the carriers, right? If that were true, then why would CIQ remain active once a device no longer has carrier service?
Let me back up for one second, CIQ claims that its services are stopped the second the SIM card is removed from the device, which is all fine and dandy... if you're on a GSM network. Those of us on CDMA networks aren't so lucky, though, because we don't use SIM cards. Thus, even when a device is deactivated from its network, it continues to send data back to the carrier, CIQ, and whoever else whenever you're on a Wi-Fi connection.
Ensure your Privacy : Use custom ROM To Protect your Privacy
Unfortunately, there is no easy way to protect yourself. There’s no switch that you can turn off in the settings of your phone or software that appears in your app drawer that you can simply uninstall. As far as the GUI of your phone is concerned, Carrier IQ isn’t even there. But it is there, hiding in the background, making sure that you don’t even know it exists. And for many, that’s just not cool. Your phone is a deeply personal device and contains lots of things (emails, photos, text messages) that many would consider totally private. Why should this company have access?
Best way, root your phone and there are many guides available for the different devices. The best place to look for information on rooting is the XDA Forum. Search on the page for your phone name and go to the “General” forum for the device. There, you should find threads with guides on how to root and get the phone ready to install custom ROMs. The process varies widely phone by phone, so we can’t give you a definitive guide here, but XDA is generally on top of the best rooting processes for the major devices.The next step is to find a ROM that supports your device that does not have Carrier IQ installed on it. Your best bet is to look for “AOSP” or “Vanilla” ROMs. These are versions of Android that have built entirely from the open source code for Android that’s released by Google each time a new version comes out. These ROMs will be free from carrier and device manufacturer tinkering, and won’t have Carrier IQ hiding in the background.
Another great custom ROM solution is Cyanogenmod. Cyanogenmod has some nice additional tweaks and features above stock Android, and is definitely the most well respected and most frequently updated custom ROM out there. Additionally, it’s available on most popular Android devices out there. The developers are even working hard on the next version, based on Android 4.0, Ice Cream Sandwich.
A simple Guide : How To Install CyanogenMod 7 On Samsung Galaxy S II Using ROM Manager is Available here.
w3af v.1.1 - Web Application Attack and Audit Framework Released
w3af is a Web Application Attack and Audit Framework. The project's goal is to create a framework to find and exploit web application vulnerabilities that is easy to use and extend. To read our short and long term objectives. w3af is much more than a piece of software, w3af is a community that breathes Web Application Security.
Change Log:
* Considerably increased performance by implementing gzip encoding
* Enhanced embedded bug report system using Trac's XMLRPC
* Fixed hundreds of bugs * Fixed critical bug in auto-update feature
* Enhanced integration with other tools (bug fixed and added more info to the file)
Download Here
Get Video Tutorial and Help to Use w3af here
MHTML vulnerability under active exploitation !
We’ve noticed some highly targeted and apparently politically motivated attacks against our users. We believe activists may have been a specific target. We’ve also seen attacks against users of another popular social site. All these attacks abuse a publicly-disclosed MHTML vulnerability for which an exploit was publicly posted in January 2011. Users browsing with the Internet Explorer browser are affected.
For now, we recommend concerned users and corporations seriously consider deploying Microsoft’s temporary Fixit to block this attack until an official patch is available.
To help protect users of our services, we have deployed various server-side defenses to make the MHTML vulnerability harder to exploit. That said, these are not tenable long-term solutions, and we can’t guarantee them to be 100% reliable or comprehensive. We’re working with Microsoft to develop a comprehensive solution for this issue.
The abuse of this vulnerability is also interesting because it represents a new quality in the exploitation of web-level vulnerabilities. To date, similar attacks focused on directly compromising users' systems, as opposed to leveraging vulnerabilities to interact with web
services.
News Source : Googleonlinesecurity
To help protect users of our services, we have deployed various server-side defenses to make the MHTML vulnerability harder to exploit. That said, these are not tenable long-term solutions, and we can’t guarantee them to be 100% reliable or comprehensive. We’re working with Microsoft to develop a comprehensive solution for this issue.
The abuse of this vulnerability is also interesting because it represents a new quality in the exploitation of web-level vulnerabilities. To date, similar attacks focused on directly compromising users' systems, as opposed to leveraging vulnerabilities to interact with web
services.
News Source : Googleonlinesecurity
EgY SpIdEr ShElL : Shell strongest in the history the hacker !
Sites get hacked every day. The bad guys often install a toolkit to control remote servers effectively. Here is one called EgY SpIdEr ShElL:
When logging in, you get a quick overview of the machine with what services are running, as well as some hardware specs.:
Brute force attacks:
HTTP form cracks:
Encoding:
Database queries:
SQL injection tool:
The origin of this toolkit seems to point to Arabic countries. It is just one of many similar hack shells that criminals use. A future blog post about other tools might be necessary
KickAssTorrents(Kat.ph) infected and serving malware through Malvertising
Coincidentally, KickAss Torrents published a blog post on Oct 10th in response to the website being flagged by antivirus vendor Avast. In it they said:
===================
Our users that are using the Avast anti-virus might have noticed that KAT.ph suddenly became labeled as a dangerous website for users that are not logged in. We want to assure our users that KickassTorrents has no malware or viruses of any kind and it is absolutely safe to use our website. We already contacted Avast and currently we are trying to find and fix the cause of this problem. You will help us if you choose the "Report the file as a false positive" option if you get the alert.
===================
In another thread, KickAss Torrents said:
===================
Now what the hell does this error mean?
First of all, don't flip out, don't go post on the KAT site, post down here if you experience the same problem.
Secondly, report down here if you experience this error.
Thirdly, add kat.ph to the safe URLs in your AV.
And lastly, please go to this site and report the problem (Avast! users only):
Avast! forum thread
Back on topic. What is this error? Does error roughly means that your anti-virus software has found some bad code in an iFrame. This could be from the site itself, or from advertisements. An iFrame is a piece of code that allows you to do several things. Embedding something to your site is a good example.
I hope this topic helps a little and I certainly hope the error is going to be fixed now.
Q&A:
Q: OMFG IS KAT HACKED?
A: Nope, just some error.
Q: Is it really safe to visit KAT?
A: Yes, it is.
===================
KickAss Torrents also referred to this discussion thread on Avast's forum. At the end of the forum it appears that Avast has acknowledged that it was indeed a false positive and have addressed the issue:
===================
Hello,
It should be solved, if not let us know please.
Miroslav JenÅ¡Ãk
AVAST Software a.s.
===================
Well, that time it might have been a false positive from Avast, but this time the website is absolutely infecting its visitors, as seen in our video.
The attacker injected the malicious script using the following url:
http://ad.kat.ph/delivery/ajs.php?zoneid=4&target=_blank&charset=UTF-8&cb=95920847237&charset=UTF-8&loc=http%3A//www.kat.ph/§ion=1939940
At the time of detection , only 2 out of 42 detected the malware in virustotal analysis.
According to Armorize,this attacker is responsible for speedtest.net incident.
Using DynDNS domains for their exploit server. Domain names are auto-calculated using Javascript. The algorithm used generates a (predicable) different dyndns.tv domain name every hour, in the format of roboABCD.tv, where ABCD are characters with a fixed seed and incremented by one character every different UTC hour.
The new dyndns domain for the next hour is generated every hour precisely at minutes 2 to 5, so this may be done by an automated mechanism.
All generated domains resolve to a single IP: 184.22.224.154 (AS21788, United States Scranton Network Operations Center Inc), located in the US.
The domain: obama-president.com resolves to this IP and is serving the same exploit pack. This domain was registered on Aug 4th through an Russian registrar, 1'ST DOMAIN NAME SERVICE www.1dns.ru. At this time the domain resolved to an Netherlands IP 85.17.93.9. The domain started to resolve to 184.22.224.154 on Aug 23rd. This IP and the president-obama.com domain are both currently still up and working.
This video show how the users infected:
How to protect your privacy while browsing the web
Online privacy protection is the most basic and essential need of an Internet user. However, since most of our work is now dependent on online activities, there is a possibility that our personal information might get hacked by some unethical elements. Therefore, it is very important to find out the different ways to achieve privacy on the Internet.
We all perform various activities on the Internet like banking, shopping, social networking, chatting, and many more that require personal information protection. While performing these activities, your personal information and location is being traced as some of the sites request you to register with your email address and ask you to create a profile with which to provide your personal information. If you are a member of any social networking site, posting a comment or participating in the forums can leave some trails of your location as well.
Why do you need personal information privacy though and what should be kept in mind while browsing the Internet? Sharing some of your personal information may lead to your online reputation being tarnished and monetary losses as hackers can take advantages of your profile or information without your knowledge.
You can help protect your privacy and browse the Internet more safely by keeping the following tips in mind:
1. Do not disclose too much of your personal information. Security of your identity starts with you. Social networking is becoming very popular nowadays but you should keep in mind not to disclose much information about yourself like your exact address and phone number. Along with it, you should not post regular updates about your upcoming travels or monetary information like credit card information since it can aid criminals in committing theft, fraud and other crimes at your expense.
2. If you are sharing your information, you should first inquire about the person with whom you are sharing it. Take precautions while becoming friendly to any unknown person and never accept a friend request from strangers. Along with that, you should not provide your private information to any new or unknown site.
3. Manage your cookies while surfing. Since cookies allow you to store information while using websites, they save your username and password every time you type it while visiting any website. In spite of that, it can also help the website owner to track who is visiting the website, the date and time of the visit and more. Sometimes, it may harm your privacy if any online criminal is tracking it. Therefore, you can delete cookies in your computer to protect your privacy. If you using windows family OS use CClearner software for clean your cache and cookies befor using internet browser .
4. some of good add-ons are available for firefox BetterPrivacy , Adblock Plus, WOT . One New Add-on FB Phishing Protector protect you from Phishing , XSS injection attacks.
By following these tips, you can more easily manage your privacy protection. Along with these, you can also opt for online identity management tools to better protect your privacy and identity while browsing the Net. These tools can help you by sending regular alerts if too much personal information is available about you online or if someone is misusing your personal information. Search the Web to get the best online identity management tool.
sqlmap 0.9 Released – SQL Injection Tool
After a year of hardcore development, sqlmap 0.9 is out!
Introduction:
sqlmap is an open source penetration testing tool that automates the process of detecting and exploiting SQL Injection flaws and taking over of database servers. It comes with a kick-ass detection engine, many niche features for the ultimate penetration testor and a broad range of switches lasting from database fingerprinting, over data fetching from the database, to accessing the underlying file system and executing commands on the operating system via out-of-band connections.
sqlmap is an open source penetration testing tool that automates the process of detecting and exploiting SQL Injection flaws and taking over of database servers. It comes with a kick-ass detection engine, many niche features for the ultimate penetration testor and a broad range of switches lasting from database fingerprinting, over data fetching from the database, to accessing the underlying file system and executing commands on the operating system via out-of-band connections.
New Features:
- Rewritten SQL injection detection engine
- Support to directly connect to the database without passing via a SQL injection, -d switch
- Added full support for both time-based blind SQL injection and error-based SQL injection techniques
- Implemented support for SQLite 2 and 3
- Implemented support for Firebird
- Implemented support for Microsoft Access, Sybase and SAP MaxDB
- Added support to tamper injection data with –tamper switch
- Added automatic recognition of password hashes format and support to crack them with a dictionary-based attack
- Added support to fetch unicode data
- Added support to use persistent HTTP(s) connection for speed improvement, –keep-alive switch
- Implemented several optimization switches to speed up the exploitation of SQL injections
- Support to parse and test forms on target url, –forms switch
- Added switches to brute-force tables names and columns names with a dictionary attack, –common-tables and –common-columns.
Demo:
Download: sqlmap-0.9.tar.gz
PacketFence – Open Source Network Access Control (NAC) System
PacketFence is a fully supported, trusted, Free and Open Source network access control (NAC) system.
Boasting an impressive feature set including a captive-portal for registration and remediation, centralized wired and wireless management, 802.1X support, layer-2 isolation of problematic devices, integration with the Snort IDS and the Nessus vulnerability scanner; PacketFence can be used to effectively secure networks – from small to very large heterogeneous networks.
What you can do with PacketFence :
- Block iPods wireless access
- Forbid rogue access points
- Perform compliance checks
- Eliminate Peer-to-Peer traffic
- Provide guest access
- Simplify VLAN management
Download: packetfence-2.1.0.tar.gz
Attackers target world's busiest stock exchanges
Attackers target world's busiest stock exchanges
British and US stock exchanges enlisted security services to thwart cyber attacks.
British and US stock exchanges enlisted the help of the security services after finding out they were the victims of cyber attacks. The London Stock Exchange is investigating a terrorist cyber attack on its headquarters last year, while US officials have traced an attack on one of its exchanges to Russia.
The Times said that was told by ‘well-placed intelligence sources' that the London Stock Exchange was trying to find the source of the attack, while a cyber security expert is reported as saying that the threat is ‘advanced and persistent'.
British govt. computers under cyber Threats
British govt. computers under cyber attacks from hostile states
British Foreign Secretary William Hague has said that cyberspace is allowing criminals and hostile intelligence agencies to attack the British government.
During a conference in Munich, Hague not only talked about how government computers were infected by a virus last year, but also detailed an attempt to steal data from a UK defence contractor. He stressed that someone in disguise of an employee of another defence firm had designed to steal information, the BBC reports.
Microsoft warns: 900 M Internet Explorer users at risk
Microsoft warns: 900 M Internet Explorer users at risk
LONDON: Microsoft has warned that the 900 million users of its Internet Explorer Web browser are at risk of having their computers hijacked and their personal information stolen by hackers.
The software giant has issued a ‘critical’ security alert over a newly-discovered flaw that affects all versions of the company’s Windows operating system, including Windows XP (SP3), Windows Vista, Windows 7, Windows Server 2003 and Windows Server 2008 (R2), reports the Daily Mail. However, Firefox, Google Chrome and Safari browsers are unaffected by the threat because, unlike Internet Explorer, they don’t support MHTML files, where the problem lies.
The loophole only seems to affect the way Internet Explorer handles some web pages.
Microsoft said that the bug is inside Windows, presumably because they don’t want users to migrate to other browsers.
The company has so far been unable to remove the bug itself and has issued a ‘fix it’ security patch to block any attempts to use it.
All Windows users, particularly those who use Internet Explorer, are being urged to download the patch as the company’s security team is working on a way to permanently fix the problem.
The company has described the flaw as a serious threat, although no hackers are thought to have yet exploited the vulnerability.
“An attacker could construct an HTML link designed to trigger a malicious script and somehow convince the targeted user to click it. When the user clicked that link, the malicious script would run on the user’s computer for the rest of the current Internet Explorer session,” said Microsoft spokeswoman Angela Gunn in a security advisory published online on Friday.
“Such a script might collect user information (e.g. email), spoof content displayed in the browser, or otherwise interfere with the user’s experience,” she added.
Save this Page
