MyAgent Trojan Targets Defense and Aerospace Industries

FireEye Security experts are analyzing a targeted trojan that leverages emailed PDF files to gain access to systems and deliver its payload to specified networks in the aerospace, chemical, defense and tech industries.

"We have seen different versions of this malware arriving as an exe inside a zipped file or as a PDF attachment. In this particular sample, the exe once executed opens up a PDF file called "Health Insurance and Welfare Policy." In addition to opening up a PDF file, the initial exe also drops another executable called ABODE32.exe (notice the typo) in the temp directory."

Resized to 95% (was 1015 x 512) - Click image to enlarge

The malware also uses JavaScript to assess which version of Adobe Reader is currently running on the host machine,and then executes attacks based on known vulnerabilities in the discovered version. Once the trojan has infected its host machine, it communicates with its command and control server, the user agent string and URI of which are hard-coded into MyAgent’s binary.

FireEye reports that most of the payloads are detected by updated antivirus software, based on research executed by running the binaries through VirusTotal.

Source: Forum - NETASQ India

BackTrack 5 R3 Released - Download Now !

The latest version of Backtrack is out! Check out Backtrack 5 R3!

“The time has come to refresh our security tool arsenal – BackTrack 5 R3 has been released.
R3 focuses on bug-fixes as well as the addition of over 60 new tools – several of which
were released in BlackHat and Defcon 2012. A whole new tool category was populated –
“Physical Exploitation”, which now includes tools such as the Arduino IDE and libraries,
as well as the Kautilya Teensy payload collection.”

Backtrack Team have released a single VMware Image (Gnome, 32 bit),
 for those requiring other VM flavors of BackTrack.

 

DSD & ASIO Websites Attacked by Anonymous for #OpAustralia

The anonymous Operation Australia hackers have today again been busy with further attacks on the ASIO and DSD website. The attacks have been taking place throughout the day and continuing right now. The website  http://www.dsd.gov.au/ appeared to be down when checked not long ago as well as http://www.asio.gov.au/ which was taken down again a short time ago.

The attacks have been part of the on going operation that is fighting out against the purposed security laws that the Australian government is attempting to bring into place in the near future.

Earlier today a member from #nulcrew released data from an Australian server in the name of the operation and over the past weeks we have seen many attacks across many different websites.

Source :CWN

LinkedIn Data Breach Costs $1 Million

Business networking site LinkedIn has announced it took a hit of up to $1 million due to one of the year's largest reported data breaches. LinkedIn spent between $500,000 and $1 million on forensic work after a large number of passwords were breached, LinkedIn CFO Steve Sordello said on the company's earnings call today.

He said the 175-million-member company continued to strengthen its website's security and is expected to add $2 million to $3 million in costs in the current quarter toward those efforts.

“Part of adding value to our members every day means ensuring that their experience on LinkedIn is safe and secure,” he said.

“Since the breach, we have redoubled our efforts to ensure the safety of member account on LinkedIn by further improving password strengthening measures and enhancing the security of our infrastructure and data. The health of our network as measured by number of growth and engagement remains as strong as it was prior to the incident.”

After the leak was discovered, LinkedIn reset the passwords of accounts that they believed were frozen.The stolen passwords were camouflaged using an outdated cryptographic hash function, SHA-1, created by the National Security Agency. In addition to this weakness, LinkedIn failed to add additional security layers, such as salting the passwords, a technique which randomly appends a string of characters.

Following the attack, LinkedIn confirmed in a blog post the addition of new security layers, including the salting of passwords.

Source : forum.netasqindia.com

The Basics of Hacking and Penetration Testing

Ethical Hacking and Penetration Testing Made Easy

Author: Patrick Engebretson

Click Here

NFC flaw allows easy hacking of Android and Nokia phones

All right, we should qualify this right out of the box: this flaw in NFC can allow pretty easy hacking of devices, but of course because of the way NFC works, the hacker needs to be really really really close to you in the first place, which does help to mitigate the security threat a bit. Still, Charlie Miller showed off a pretty easy hack at the Black Hat security conference using Samsung Android handsets and Nokia MeeGo handsets. 

Of course, as we said, the attacking device (either a standalone chip, or other NFC-enabled device) has to be just a few centimeters from the target device in order to use the NFC exploit. The hack works by beaming malicious code wirelessly to the target device, and once deployed the code will exploit a known vulnerability through files or webpages in a document reader or browser, or even in the operating system itself. So, essentially, the NFC exploit is really just an extremely easy delivery system for malicious code rather than a direct exploit of the systems. 

The exploit was shown on a Nexus S running Android 2.3 Gingerbread, and a Galaxy Nexus running Android 4.0 Ice Cream Sandwich. It's unclear how the new security features of Jelly Bean factor into this. The exploit was also shown on the Nokia N9. The basic problem is that once NFC interactions are enabled (default on with Android, but default off in MeeGo), all files are automatically accepted without any options by users to refuse files. Since files are automatically accepted, it makes it much easier to load malicious code on a target device, assuming you can get close enough to do so
Source: netasq-India

CVE-2012-2808 : Android 4.0.4 DNS poisoning vulnerability Exposed

Android's DNS resolver is vulnerable to DNS poisoning due to weak randomness in its implementation. Researchers Roee Hay & Roi Saltzman from IBM Application Security Research Group demonstrate that how an attacker can successfully guess the nonce of the DNS request with a probability thatis suficient for a feasible attack. Android version 4.0.4 and below are Vulnerable to this bug

 

 

 

Weakness in its pseudo-random number generator (PRNG), which makes DNS poisoning attacks feasible. DNS poisoning attacks may endanger the integrity and con dentiality of the attacked system. For example, in Android, the Browser app can be attacked in order to steal the victim's cookies of a domain of the attacker's choice. If the attacker manages to lure the victim to browse to a web page controlled by him/her, the attacker can use JavaScript, to start resolving non-existing sub-domains.

Upon success, a sub-domain points to the attacker's IP, which enables the latter to steal wild card cookies of the attacked domain, and even set cookies. In addition, a malicious app instantiate the Browser app on the attacker's malicious web-page. If the attacker knows the PID (for example, a malicious app can access that information), the attack expected time can be reduced furthermore.

Vulnerability dubbed as "CVE-2012-2808" Android 4.1.1 has been released, and patches are available on AOSP. The random sample is now pulled from /dev/urandom, which should have adequate entropy by the time network activity occurs.

 

 Source: netasq-India

8 million passwords dumped from gaming website Gamigo

Four months after the gaming site Gamigo warned users about a hacker intrusion that accessed some portions of its users’ credentials, more than 8 million usernames, emails and and encrypted passwords from the site have been published on the Web, according to the data breach alert service PwnedList.

The list of passwords, which were scrambled using a one-way cryptographic hash algorithm, were published earlier this month to a forum on the password-cracking website Inside Pro. According to forbe,"The list also contained 8.2 million unique e-mail addresses, including 3 million American accounts from the US, 2.4 million accounts from Germany, and 1.3 million accounts from France."

Gamigo warned users in early March that an attack on the Gamigo database had exposed hashed passwords and usernames and possibly other, unspecified additional personal data. The site required users to change their account passwords.

 

 

 

 

 

PwnedList founder Steve Thomas said, “It’s the largest leak I’ve ever actually seen. When this breach originally happened, the data wasn’t released, so it wasn’t a big concern. Now eight million email addresses and passwords have been online, live data for any hacker to see.

This breach is bigger than anything we've seen so far this year. In the last few months, there have been a slew of attacks against the following sites: LinkedIn, eHarmony, Last.fm, Yahoo, Android Forums, Formspring, and Nvidia, among others.

Gamigo users can check on PwnedList’s site whether their email address is included in the leak.

On March 1, Gamigo sent out the following e-mail to its users:

Dear Community,

As you have all already noticed, our game servers, websites and forums are partially unreachable at the moment. We would like to explain to you what happened and what has been done on our side.

There was an attack on the gamigo database in which user information, such as alias usernames and encrypted passwords were stolen. An excerpt from these was published in the gamigo forums. We detected the attack and are working to the utmost of our resources to repair the damage and determine how it happened.

Your character data, including items, is safely stored on the backup! We cannot rule out that the intruder(s) is/are still in possession of additional personal data, although to date we have received no report of any fraudulent use.

To prevent any unauthorized access to your account, we have reset all passwords for the gamigo account system and for all gamigo games!

 

Source: netasq-India

 

Reliance Communications Server Compromised with Information disclosure Vulnerability

Hacker with nickname "mr.hack3r420" has successfully compromise the web server of Reliance Communications (rcom.co.in) as shown in image (screenshot taken by THN team and we make link hidden to save site from further misuse of damage).

 

Hacker most probably get this access because of Information disclosure Vulnerability in Reliance website.Most of the Folders on website are visible to everyone publicly and there is a interesting file called "Upload_AppId_VId.php" available , using which hacker may be able to upload his own php shell on the server to get access to FTP and Linux User account

This is not the first time Reliance become the victim, a few months back, hacker named "nomcat" was able to access Reliance Communications ISP server, and he release the list of all blocked sites by Reliance to Protest against Internet Censorship.

Source : netasq India

FACT : One in five MICROSOFT Logins Controlled by Hackers

About 20 percent of Microsoft Account logins are found on lists of compromised credentials in the wake of hack attacks on other service providers, Eric Doerr, Group Program Manager for Microsoft's Account system said.

A significant proportion of compromised credentials Microsoft sees from other services have the same username and password on the Microsoft account system (formerly Windows Live ID) logins, which cover services such as Hotmail, Messenger and SkyDrive. These logins have not been compromised from the Microsoft server, but are instead based on login information leaked from other sites.

                                            

 These attacks shine a spotlight on the core issue people reuse passwords between different websites," he said. Microsoft regularly gets lists of compromised third-party login details from ISPs, law enforcement and vendors, as well as from lists published on the internet by hackers, according to Doerr. This information is checked against Microsoft login details using an automated process to check for any overlap. While 20 percent is the average, in one recent breach it was only 4.5 percent, said Doerr.

 

Like Just last week, both Yahoo! Voices and the Android forums at website Phandroid were hacked, resulting in the leakage of almost 1.5 million usernames and passwords. When a list of usernames and passwords are leaked, it seems that Microsoft have been running these against its database looking for matches. The results are quite shocking.

Company also revealed that it is working to tighten its security and one of such measures is going to be increase in the character limit in passwords to make Brute Force attack more difficult.

We Request to Readers, DON’T REUSE YOUR PASSWORDS!

 

 Source:THN

APPLE'S app-store-bypassed-by-russian-hacker

                                                                                                                                             

Apple is investigating yet another security breach in its iTunes app store . A Russian hacker worked out a way that allows people to bypass payment in the App Store and download products for free.

The hacker, dubbed ZonD80, posted a video of the crack on YouTube (Deleted by Youtube now) and claims that the technique makes it possible to beat Apple's payment systems by installing a couple of certificates and assigning a specific IP address to the device.

The new service, which has already been subject to attempts at shutting it down, requires no jailbreaking and only minimal configuration changes. It works by funneling purchase requests through a server operated by the hacker, rather than the legitimate one offered by Apple. As a result, charges that normally would be applied to a user's account are bypassed.

                                                                                                                                                                                                    

Below are the steps to the hack:

• Install two certificates: CA and in-appstore.com.
• Connect via Wi-Fi network and change the DNS to 62.76.189.117.
• Press the Like button and enter your Apple ID & password.
• Using the above hack, you are actually stealing in-app purchase content from developers, which is kind of disturbing and is of course against developer’s terms of service.

ZonD80 is now asking for donations to set up a website to promote the hack."Why you must to pay for content, already included in purchased app? I think, you must not," he said.

Apple has responded with the following statement:“The security of the App Store is incredibly important to us and the developer community,” Apple representative Natalie Harrison. “We take reports of fraudulent activity very seriously and we are investigating.”

For Best Training on Hacking visit www.zoomgroup.com

join ZOOM TECHNOLOGIES on facebook