Google Chrome blocks access to Twitpic for Malware risk

Suddenly today Google Chrome start detecting Twitpic.com as malware threat. Twitpic is one of the most popular website for Sharing photos and videos on Twitter. Twitpic denies and said that there is no malware on the website and is trying to contact Google.

We also notice that, Twitter profiles and pages with Twitpic URL in tweets are also blocked curretly by Chrome. Many people also complaining about this on Google Help forum.

An official statement from Twitpic via tweet,"Working to fix the google chrome malware notice when visiting Twitpic.com as this is not true or the case, trying to contact google".

Google's Safe Browsing Diagnostic page for twitpic.com saying, "Site is listed as suspicious - visiting this web site may harm your computer. Of the 12029 pages we tested on the site over the past 90 days, 0 page(s) resulted in malicious software being downloaded and installed without user consent. The last time Google visited this site was on 2012-12-30, and suspicious content was never found on this site within the past 90 days."

Also Google report said,"No, this site has not hosted malicious software over the past 90 days. In some cases, third parties can add malicious code to legitimate sites, which would cause us to show the warning message."

Source: THN

Official Certified Ethical Hacker Review Guide, for Version 7.1

Official Certified Ethical Hacker Review Guide, for Version 7.1: Exam 312-50

 By Steven DeFino, Larry Greenblatt

WordPress Pingback Vulnerability Serves DDoS attack feature

Accunetix a web application security company reported vulnerabilities found in the Wordpress Pingback feature. According to report, Pingback vulnerability exists in the WordPress blogging platform that could leak information and lead to distributed denial of service (DDoS) attacks.

"WordPress has an XMLRPC API that can be accessed through the xmlrpc.php file. When WordPress is processing pingbacks, it's trying to resolve the source URL, and if successful, will make a request to that URL and inspect the response for a link to a certain WordPress blog post. If it finds such a link, it will post a comment on this blog post announcing that somebody mentioned this blog post in their blog." Bogdan Calin explained.

A new tool has been released that automates the pingback vulnerability autonomously, distributed on the software development site Github as "WordpressPingbackPortScanner" . That tool exposes the API and lets attackers scan other hosts, multiple WordPress blogs and with a specialized URL, reconfigure routers.

Tool description - "Wordpress exposes a so called Pingback API to link to other blogposts. Using this feature you can scan other hosts on the intra- or internet via this server. You can also use this feature for some kind of distributed port scanning: You can scan a single host using multiple Wordpress Blogs exposing this API."

The bug is already reported on Wordpress community, but Softpedia notice that the ticket was closed at the time after someone argued that “there are so many ways to orchestrate a DDOS attack.”

All the wordpress blogs are at risk,can be heavily  abused by attackers. Since the Wordpress also supports URL credentials , the attacker can use a link like http://admin:admin@192.168.0.1/changeDNS.asp?newDNS=aaaa to reconfigure internal routers.

He also says that disabling the Pingback feature won't fix the solution ,the ultimate solution is a patch.

Source: THN

Samsung smart TV vulnerability allow attacker to read storage remotely

 ReVuln Ltd. , a small security company headed by Donato Ferrante and Luigi Auriemma, post a video that demonstrates that how attacks can gain root on the appliances.

Samsung smart vulnerability allow attacker to read storage remotely

Samsung Smart TV contain a vulnerability which allows remote attackers to swipe data from attached storage devices.

In this demonstration readers will see how it is possible to use a 0-day vulnerability to retrieve sensitive information, root access, and ultimately monitor and fully control the device remotely.

Auriemma said, “We have tested different Samsung televisions of the latest generations running the latest version of their firmware. Unfortunately we can't disclose additional information but we can only say that almost all the people having a Samsung TV at home or in their offices are affected by this vulnerability.".

Source: THN

Todd Lammle's CCNA IOS Commands Survival Guide

 By Todd Lammle

CCNP 70-410 

For Best CISCO/MCITP/LINUX/EXCHANGE SERVER/PC HARDWARE AND  NETWORKING Training visit www.zoomgroup.com
Join us on facebook

Introducing Windows Server 2012

 

Introducing Windows Server 2012

 By Mitch Tulloch


For Best CISCO/MCITP/LINUX/EXCHANGE SERVER/PC HARDWARE AND  NETWORKING Training visit www.zoomgroup.com
Join us on facebook

Worst password of 2012, Have you ever used one of these ?

 This year we have seen some big Security breaches that expose millions of passwords like Yahoo!, LinkedIn, eHarmony and Last.fm, among others , SplashData Reveals Its Annual "25 Worst Passwords of the Year" List.
how-secure-is-my-password_TIMuW_25552_530x302
The three worst passwords haven't changed since 2011; they're password, 123456 and 12345678. The new worst passwords added to this year's list include welcome, jesus, ninja, mustang and password1. Have you ever used one of the most popular passwords of 2012 for your own personal accounts?

SplashData CEO Morgan Slain stated “At this time of year, people enjoy focusing on scary costumes, movies and decorations, but those who have been through it can tell you how terrifying it is to have your identity stolen because of a hacked password.”

 “We’re hoping that with more publicity about how risky it is to use weak passwords, more people will start taking simple steps to protect themselves by using stronger passwords and using different passwords for different websites.”

I am sure hope you didn't find one of your passwords. If you did, I highly advise you switch it fast. In order to create a safer password, use security phrases with at least eight characters while utilizing a variety of characters within the phrase. Also use multiple passwords across different types of sites.

Password management applications also can help users keep track of their passwords and avoid using the same password for multiple sites, which is another bad practice, especially when mixing, say, entertainment and social networking sites with financial services