Who are Hackers ?

Hacking Facebook Password like chaning your our password

Hacker found a way to hack and change your password like, just he used to change his own password. Confused ? Recently Facebook fix a very critical vulnerability on the tip of 'Sow Ching Shiong', an independent vulnerability researcher. Flaw allows anyone to reset the password of any Facebook user without knowing his last password.

At Facebook, there is an option for compromised accounts at "https://www.facebook.com/hacked" , where Facebook ask one to change his password for further protection. This compromised account recovery page, will redirect you to another page at "https://www.facebook.com/checkpoint/checkpointme?f=[userid]&r=web_hacked" .

Researcher notice that the URL of the page having a parameter called "f" which represents your user ID and replacing the user ID with victim's user ID allow him to get into next page where attacker can reset the password of victim without knowing his last password.

The Vulnerability was very simple to execute, but now patched by Facebook Security Team.

Official Certified Ethical Hacker Review Guide, for Version 7.1

Official Certified Ethical Hacker Review Guide, for Version 7.1: Exam 312-50

 By Steven DeFino, Larry Greenblatt

Your Friend can help Investigators to Access your Facebook Profile

If you’re not already particularly picky about who you friend on Facebook, you might wantto think about rejiggering those privacy settings. It's not the backdoor access that the FBI has been pushing for, but US District Judge William Pauley III has now ruled that it and other law enforcement agencies are entitled to view your Facebook profile if one of your "friends" gives them permission to do so.

As GigaOm reports, a New York City federal judge ruled in a recent racketeering trial that it’s legal for police to view your Facebook profile if one of your friends grants them permission.

Better start sniffing out the rats on your friends list.

That’s because all of that data that you think is personal really isn’t that personal after all, according to the Judge. "Colon’s legitimate expectation of privacy ended when he disseminated posts to his friends because those friends were free to use the information however the wanted including sharing it with the Government."

Both government agencies and private companies alike are mining social media to gain additional knowledge. Whether it’s a criminal investigation like this one or insurance companies reportedly combing through Facebook profiles to determine the party at fault in an auto accident, the freedom and public nature of social media can work both for and against its users.

Ultimately, users have to be aware of the public status of online information as well as the ease with which it can be obtained. Don’t post anything you don’t want to be found or seen.

Source: Forum - NETASQ India

LinkedIn Data Breach Costs $1 Million

Business networking site LinkedIn has announced it took a hit of up to $1 million due to one of the year's largest reported data breaches. LinkedIn spent between $500,000 and $1 million on forensic work after a large number of passwords were breached, LinkedIn CFO Steve Sordello said on the company's earnings call today.

He said the 175-million-member company continued to strengthen its website's security and is expected to add $2 million to $3 million in costs in the current quarter toward those efforts.

“Part of adding value to our members every day means ensuring that their experience on LinkedIn is safe and secure,” he said.

“Since the breach, we have redoubled our efforts to ensure the safety of member account on LinkedIn by further improving password strengthening measures and enhancing the security of our infrastructure and data. The health of our network as measured by number of growth and engagement remains as strong as it was prior to the incident.”

After the leak was discovered, LinkedIn reset the passwords of accounts that they believed were frozen.The stolen passwords were camouflaged using an outdated cryptographic hash function, SHA-1, created by the National Security Agency. In addition to this weakness, LinkedIn failed to add additional security layers, such as salting the passwords, a technique which randomly appends a string of characters.

Following the attack, LinkedIn confirmed in a blog post the addition of new security layers, including the salting of passwords.

Source : forum.netasqindia.com

NFC flaw allows easy hacking of Android and Nokia phones

All right, we should qualify this right out of the box: this flaw in NFC can allow pretty easy hacking of devices, but of course because of the way NFC works, the hacker needs to be really really really close to you in the first place, which does help to mitigate the security threat a bit. Still, Charlie Miller showed off a pretty easy hack at the Black Hat security conference using Samsung Android handsets and Nokia MeeGo handsets. 

Of course, as we said, the attacking device (either a standalone chip, or other NFC-enabled device) has to be just a few centimeters from the target device in order to use the NFC exploit. The hack works by beaming malicious code wirelessly to the target device, and once deployed the code will exploit a known vulnerability through files or webpages in a document reader or browser, or even in the operating system itself. So, essentially, the NFC exploit is really just an extremely easy delivery system for malicious code rather than a direct exploit of the systems. 

The exploit was shown on a Nexus S running Android 2.3 Gingerbread, and a Galaxy Nexus running Android 4.0 Ice Cream Sandwich. It's unclear how the new security features of Jelly Bean factor into this. The exploit was also shown on the Nokia N9. The basic problem is that once NFC interactions are enabled (default on with Android, but default off in MeeGo), all files are automatically accepted without any options by users to refuse files. Since files are automatically accepted, it makes it much easier to load malicious code on a target device, assuming you can get close enough to do so
Source: netasq-India

CVE-2012-2808 : Android 4.0.4 DNS poisoning vulnerability Exposed

Android's DNS resolver is vulnerable to DNS poisoning due to weak randomness in its implementation. Researchers Roee Hay & Roi Saltzman from IBM Application Security Research Group demonstrate that how an attacker can successfully guess the nonce of the DNS request with a probability thatis suficient for a feasible attack. Android version 4.0.4 and below are Vulnerable to this bug

 

 

 

Weakness in its pseudo-random number generator (PRNG), which makes DNS poisoning attacks feasible. DNS poisoning attacks may endanger the integrity and con dentiality of the attacked system. For example, in Android, the Browser app can be attacked in order to steal the victim's cookies of a domain of the attacker's choice. If the attacker manages to lure the victim to browse to a web page controlled by him/her, the attacker can use JavaScript, to start resolving non-existing sub-domains.

Upon success, a sub-domain points to the attacker's IP, which enables the latter to steal wild card cookies of the attacked domain, and even set cookies. In addition, a malicious app instantiate the Browser app on the attacker's malicious web-page. If the attacker knows the PID (for example, a malicious app can access that information), the attack expected time can be reduced furthermore.

Vulnerability dubbed as "CVE-2012-2808" Android 4.1.1 has been released, and patches are available on AOSP. The random sample is now pulled from /dev/urandom, which should have adequate entropy by the time network activity occurs.

 

 Source: netasq-India

8 million passwords dumped from gaming website Gamigo

Four months after the gaming site Gamigo warned users about a hacker intrusion that accessed some portions of its users’ credentials, more than 8 million usernames, emails and and encrypted passwords from the site have been published on the Web, according to the data breach alert service PwnedList.

The list of passwords, which were scrambled using a one-way cryptographic hash algorithm, were published earlier this month to a forum on the password-cracking website Inside Pro. According to forbe,"The list also contained 8.2 million unique e-mail addresses, including 3 million American accounts from the US, 2.4 million accounts from Germany, and 1.3 million accounts from France."

Gamigo warned users in early March that an attack on the Gamigo database had exposed hashed passwords and usernames and possibly other, unspecified additional personal data. The site required users to change their account passwords.

 

 

 

 

 

PwnedList founder Steve Thomas said, “It’s the largest leak I’ve ever actually seen. When this breach originally happened, the data wasn’t released, so it wasn’t a big concern. Now eight million email addresses and passwords have been online, live data for any hacker to see.

This breach is bigger than anything we've seen so far this year. In the last few months, there have been a slew of attacks against the following sites: LinkedIn, eHarmony, Last.fm, Yahoo, Android Forums, Formspring, and Nvidia, among others.

Gamigo users can check on PwnedList’s site whether their email address is included in the leak.

On March 1, Gamigo sent out the following e-mail to its users:

Dear Community,

As you have all already noticed, our game servers, websites and forums are partially unreachable at the moment. We would like to explain to you what happened and what has been done on our side.

There was an attack on the gamigo database in which user information, such as alias usernames and encrypted passwords were stolen. An excerpt from these was published in the gamigo forums. We detected the attack and are working to the utmost of our resources to repair the damage and determine how it happened.

Your character data, including items, is safely stored on the backup! We cannot rule out that the intruder(s) is/are still in possession of additional personal data, although to date we have received no report of any fraudulent use.

To prevent any unauthorized access to your account, we have reset all passwords for the gamigo account system and for all gamigo games!

 

Source: netasq-India

 

Russian Hacker Arrested For DDoS Attacks on Amazon

Dmitry Olegovich Zubakha, a Russian man accused of launching distributed-denial-of-service (DDOS) attacks on Amazon.com, has been arrested this week by authorities in Cyprus based on an international warrant, the Department of Justice revealed.

Zubakha, a native of Moscow, was indicted for two denial of service attacks in 2008 on the Amazon.com website. The indictment, unsealed Thursday, also details denial of service attacks on Priceline.com and eBay.

                                             

"Orders from Amazon.com customers dropped significantly, as legitimate customers were unable to access the website and complete their e-commerce transactions during the pendency of the attack," read an indictment unsealed in district court in western Washington on Thursday. The botnet involved requested "large and resource-intensive web pages" on a magnitude of between 600 and 1,000 percent of normal traffic levels, according to the indictment.

The hacker is charged with conspiracy to intentionally cause damage to a protected computer, possession of more than 15 unauthorized access devices, aggravated identity theft, and intentionally causing damage to a computer resulting in a loss of over $5,000 (4,000 EUR).

Zubakha and his friend claimed credit for the attacks on online hacker forums, and law enforcement traced 28,000 stolen credit card numbers to the pair in 2009. For that reason, Zubakha and his partner are also charged with aggravated identity theft for illegally using the credit card of at least one person.

The charges faced by Zubakha carry potential penalties of up to 10 years in prison and a $250,000 (£160,000) fine.

 

Source:netasq-India

Reliance Communications Server Compromised with Information disclosure Vulnerability

Hacker with nickname "mr.hack3r420" has successfully compromise the web server of Reliance Communications (rcom.co.in) as shown in image (screenshot taken by THN team and we make link hidden to save site from further misuse of damage).

 

Hacker most probably get this access because of Information disclosure Vulnerability in Reliance website.Most of the Folders on website are visible to everyone publicly and there is a interesting file called "Upload_AppId_VId.php" available , using which hacker may be able to upload his own php shell on the server to get access to FTP and Linux User account

This is not the first time Reliance become the victim, a few months back, hacker named "nomcat" was able to access Reliance Communications ISP server, and he release the list of all blocked sites by Reliance to Protest against Internet Censorship.

Source : netasq India

FACT : One in five MICROSOFT Logins Controlled by Hackers

About 20 percent of Microsoft Account logins are found on lists of compromised credentials in the wake of hack attacks on other service providers, Eric Doerr, Group Program Manager for Microsoft's Account system said.

A significant proportion of compromised credentials Microsoft sees from other services have the same username and password on the Microsoft account system (formerly Windows Live ID) logins, which cover services such as Hotmail, Messenger and SkyDrive. These logins have not been compromised from the Microsoft server, but are instead based on login information leaked from other sites.

                                            

 These attacks shine a spotlight on the core issue people reuse passwords between different websites," he said. Microsoft regularly gets lists of compromised third-party login details from ISPs, law enforcement and vendors, as well as from lists published on the internet by hackers, according to Doerr. This information is checked against Microsoft login details using an automated process to check for any overlap. While 20 percent is the average, in one recent breach it was only 4.5 percent, said Doerr.

 

Like Just last week, both Yahoo! Voices and the Android forums at website Phandroid were hacked, resulting in the leakage of almost 1.5 million usernames and passwords. When a list of usernames and passwords are leaked, it seems that Microsoft have been running these against its database looking for matches. The results are quite shocking.

Company also revealed that it is working to tighten its security and one of such measures is going to be increase in the character limit in passwords to make Brute Force attack more difficult.

We Request to Readers, DON’T REUSE YOUR PASSWORDS!

 

 Source:THN

Skype privacy bug that can Send Messages To The Wrong Contacts

    

What if when you sent a message to someone, it had a very good chance of going to someone else in your contact list? That would be pretty scary right? That what some Skype users are reporting.

The bug was first discussed in Skype’s user forums, and seems to have followed a June 2012 update of the Skype software. Skype has confirmed the bug existence and that a fix is in the works. However, the company characterizes the bug as “rare.”

Purchased by Microsoft last year for $8.5 billion, the Luxemburg company which has as many as 40 million people using its service at a time during peak periods, explained that messages sent between two users were in limited cases being copied to a third party, but did not elaborate further on the matter.

Five other individuals of the Microsoft-owned program confirmed they were also seeing instant messages being sent to the wrong person from their contact list. Sometimes it's just a few messages, while other times it's a whole conversation.

Skype has, on its blog, confirmed the issue of a bug sending instant messages to wrong contacts and has promised a fix. Addressing the issue, Skype wrote, "Based on recent Skype customer forum posts and our own investigation over the past couple of days, we have identified a bug that we are working hard to fix."

Source:THN

kindly  visit www.zoomgroup.com

join us on facebook

Bulgarian Hackers Group Arrested

Bulgarian Hackers Group arrested

Bulgarian authorities say that after months of investigation they have busted the “most powerful hacker group” in the country, the Cyber Warrior Invasion. The operation was conducted by Bulgaria’s Sector for Computer Crimes, Intellectual Property and Gambling and the territorial units of the Chief Directorate for Fight with Organized Crime in the municipalities of Pleven, Shumen, Plovdiv, Burgas, Haskovo, Stara Zagora and Kyustendil.

Using cyber “terrorist” methods, the group had attacked more than 500 websites worldwide, including those of financial institutions, web-based companies, and governmental and non-governmental organizations. On the confiscated computers, police discovered databases with large amounts of stolen emails, social network profiles and associated passwords, as well as stolen credit card data.

The site www.cwi-group.org was used by the members of the group to coordinate their activities. Constantly changing its location and using a complex system of "zombie" proxy servers they disguised its true location, and that of the administrators. Despite the attempts to wipe out their tracks, hackers were detected.The investigation unveiled that hacker group members followed a strict hierarchical order, evidencing the high degree of organization and coordination between them. They were structured into different groups according to their access and power: "Administrators", "Moderator", "Scanning team," "Donors / Sponsors", "Sectional moderators", "Friends," "VIP Members" and group "members."

Four laptops, five desktop computers, seven portable digital information devices, three hard discs and over 200 CDs were seized.

Sourc: THN

for best Ethical Hacking and Counter Measures Training visit www.zoomgroup.com

Hacking For Dummies By Kevin Beaver, Stuart McClure

Name of Book:Hacking for Dummies
Author : Kevin Beaver
Please click HERE
For more updates visit www.zoomgroup.com.
Join ZOOM TECHNOLOGIES on facebook

Special Combo offer (CCNP+EHCE) INR 18,000*/USD 360*/GBP 228*/NGN 57,249*

Special Combo offer and Package Price

CCNP+EHCE

INR 18,000*/USD 360*/GBP 228*/NGN 57,249*

Please visit www.zoomgroup.com for more details