Mozilla asks Court to disclose Firefox Exploit used by FBI to hack Tor users

Mozilla has filed a brief with a U.S. District Court asking the FBI to disclose the potential vulnerabilities in its Firefox browser that the agency exploited to unmask TOR users in a criminal investigation.

Last year, the FBI used a zero-day flaw to hack TOR browser and de-anonymize users visiting child sex websites.

Now, Mozilla is requesting the government to ask the FBI about the details

Pornhub Launches Bug Bounty Program; Offering Reward up to $25,000

With the growing number of cyber attacks and data breaches, a significant number of companies and organizations have started Bug Bounty Programs to encourage hackers and security researchers to find and responsibly report bugs in their services and get a reward.

Now, even pornography sites are starting to embrace bug bounty practices in order to safeguard its user's security.

Top 4 Data Breaches reported in last 24 Hours

There is no doubt that data breaches are on the rise. Hardly a day goes without headlines about any significant data breach.

According to the latest ‘Cyber Security Breaches Survey 2016’ report published by UK government, two-thirds of the biggest firm in the UK have experienced at least a cyber attacks or data breaches within the past 12 months.

Here’s today, I am writing about top 4 data

Hacker Arrested after Exposing Flaws in Elections Site

A security researcher responsibly disclosed vulnerabilities in the poorly secured web domains of a Florida county elections, but he ended up in handcuffs on criminal hacking charges and jailed for six hours Wednesday.

Security researcher David Michael Levin, 31, of Estero, Florida was charged with three counts of gaining unauthorized access to a computer, network, or electronic instrument.

Warning — Widely Popular ImageMagick Tool Vulnerable to Remote Code Execution

A serious zero-day vulnerability has been discovered in ImageMagick, a widely popular software tool used by a large number of websites to process user's photos, which could allow hackers to execute malicious code remotely on servers.

ImageMagick is an open-source image processing library that lets users resize, scale, crop, watermarking and tweak images.

The ImageMagick tool is supported by

Hacker Installed a Secret Backdoor On Facebook Server to Steal Passwords

How to Hack Facebook?

That’s the most commonly asked question during this decade.

It’s a hacker dream to hack Facebook website for earning bug bounty or for any malicious purpose.

Facebook security team recently found that someone, probably a blackhat hacker with malicious intent, has breached into its server and installed a backdoor that was configured to steal Facebook employees' login

Journalist Matthew Keys gets 2-Year Prison term for helping Anonymous Hackers

Former Reuters journalist Matthew Keys, who was convicted last year of helping the Anonymous group of hackers, has been sentenced to 24 months in prison for computer hacking charges.



Keys was found guilty last year in October of giving Anonymous login credentials that allowed the group to deface the Los Angeles Times, a Tribune Media-owned newspaper, back in 2013.



After leaving the job

Warning — Linux Mint Website Hacked and ISOs replaced with Backdoored Operating System

Are you also the one who downloaded Linux Mint on February 20th? You may have been Infected!



Linux Mint is one of the best and popular Linux distros available today, but if you have downloaded and installed the operating system recently you might have done so using a malicious ISO image.



Here's why:



Last night, Some unknown hacker or group of hackers had managed to hack into the

Mr. Grey Hacker (Wanted by FBI) Steals 1.2 BILLION Login Passwords

That's a lot of Login credentials fetch by a single hacker.



The FBI believes a single hacker who goes by the moniker Mr.Grey has stolen login credentials for over 1.2 Billion online accounts – apparently the biggest heist of log-in credentials the FBI has investigated thus far.



Yeah, that's not Fifty, but 1.2 Billion Shades of Grey.



The information came from the court

Joomla 3.4.5 patches Critical SQL Injection Vulnerability

Joomla – one of the most popular open source Content Management System (CMS) software packages, has reportedly patched three critical vulnerabilities in its software.



The flaws, exist in the Joomla version 3.2 to 3.4.4, include SQL injection vulnerabilities that could allow hackers to take admin privileges on most customer websites.



The patch was an upgrade to Joomla version 3.4.5 and

Bitcoin Cloud Mining Service Hacked; Database On Sale for Just 1 Bitcoin

Bitcoin Cloud Mining service Cloudminr.io has been hacked and its whole users database is on sale for 1 Bitcoin.



The unknown hackers have successfully taken full control of the website's server and defaced the homepage of the website.



Users visiting the website are greeted with a defaced homepage showing the partial database of around 1000 clients including their usernames and

Gaana.com Hacked, 10 Million Users' Details Exposed

Gaana.com -- One of India's most popular music streaming service with more than 10 Million registered users and 7.5 Million monthly visitors -- has reportedly been hacked, exposing the site’s user information database.



A Pakistani hacker, who claimed responsibility for the hack, claims that details of over 10 Million users of Gaana service including their username, email addresses,

Drupal Patches Critical Password-Reset Vulnerability

Drupal, one of the widely used open source content management system is recommending its users to update their software to the latest versions 6.35 and 7.35 after the company discovered two moderately critical vulnerabilities that may allow an attacker to hack Drupal websites.



According to a security advisory published yesterday, a flaw found in the Drupal core could allow a potential

MongoDB phpMoAdmin GUI Tool Zero-day Vulnerability Puts Websites at Risk

About two weeks back, over 40,000 organizations running MongoDB were found unprotected and vulnerable to hackers. Now, once again the users of MongoDB database are at risk because of a critical zero-day vulnerability making rounds in underground market.



MongoDB, one of the leading NoSQL databases, is an open-source database used by companies of all sizes, across all industries for a wide

Use Jack For ClickJacking Development Assistance Tool

Use Jack For ClickJacking Development Assistance Tool.

Clickjacking POC development tool. Jack is a static HTML and JavaScript web-based tool. To get Jack up and running, serve the index.html file in a manner of your choice and ClickJack away. Be sure to check your browser settings when PoC'ing HTTPS based targets as most browsers will not allow embedding HTTPS resources into iFrames.

Download 

Lenovo Website Is Still Under Construction After Hacked By Lizard Squad

Lenovo Website Is Still Under Construction After Hacked By Lizard Squad.

After the Superfish Malware incident, Lenovo official website is suffering from cyber attack by hacking group called Lizard Squad. It was revealed earlier this week that Lenovo had been pre-installing controversial 'Superfish' adware to its laptops which compromised the computer's encryption certificates to quietly include more ads on Google search.

“We’re breaking free! Soarin’, flyin’, there’s not a star in heaven that we can’t reach!,” Lizard Squad posted on its Twitter page, quoting the song from the movie “High School Musical”.

The hacker group also posted a couple of screenshots of an email between Lenovo employees regarding the “Superfish” software.

On Lenovo website, Company apologies to there visitors with message,

"The Lenovo Web site is currently unavailable but will return soon. To place or check on the status of an order or for any other enquiries, please contact a Lenovo representative during regular business hours."

What is Superfish Adware?
Last friday dozen of Lenovo Laptops are compromised by SSL Spoofing attacks. Where cyber attackers can read HTTPS web traffic to perform the attacks.

You can also do check whether you laptop is compromised by Superfish or not by https://filippo.io/Badfish/. If you see a "YES" then you might have a problem. And if the message output is ,"GOOD, Superfish is probably not intercepting your connections", then you are safe.

About Lenovo:
Lenovo Group Ltd. is a Chinese multinational computer technology company with headquarters in Beijing, China, and Morrisville, North Carolina, United States. Company revenue $38.70 billion at 2014.

Facebook Bug - Open Redirection To Blocked Sites

Facebook Bug - Open Redirection To Blocked Sites

---

Link Shim Of Facebook (l.php) 

---

A very good explanation for 'Link Shim' can be found here. It is a sweet note written by one of the security engineer at Facebook. In short, Facebook tries to protect their users by creating a list of harmless sites and harmful sites. So, sites which are malicious and are marked as `harmful` cannot be used on facebook.

eg. A user cannot post a link of a blocked site.

Try to post `http://ringcloud.com` on Facebook. You won't be allowed and a `warning` message will be displayed saying that `ringcloud.com` is blocked.

---

Send Dialog

---

Facebook introduced a 'Send Dialog' long time back. You can find details about it here. It was designed for sending private messages with `links` to one's friends, etc. It can be integrated on third party sites.

Have a look at this
https://www.facebook.com/dialog/send?app_id=145634995501895&link=http://www.pranavhivarekar.in/2014/10/hackerone-bug-redirect-filter-bypass.html&redirect_uri=https://www.google.com

The 'Send Dialog' accepts few parameters.
1. app_id (App needs to be created for using send dialog)
2. link (Link to be shared)
3. redirect_uri (Redirection to site mentioned here after sending message)

After pressing `Send` or `Cancel` user will be redirected to the site mentioned in `redirect_uri`.

---

Final Exploit 

---

The values passed to `link` parameter were getting passed through 'Link Shim'. So, attacker is limited to share only those links which are present in `harmless` list of link shim.
eg. Attacker can share any link like `http://pranavhivarekar.in`.

Now, note other `redirect_uri` parameter. I observed that it was not passed through link shim. So. attacker can redirect victims to any site after sending message.
eg. Attacker can redirect users to any site like `http://pranavhivarekar.in`.

So, what is the bug here?
I checked `redirect_uri` parameter against `harmful` list of 'Link Shim' and was really amused and glad to see the redirection to `harmful` site.
eg. I entered `http://ringcloud.com` and after `Sending`message or pressing `Cancel` it redirected me to `http://ringcloud.com`

So, it proves that there were no access controls placed to protect users from redirection to `harmful` sites and it did violate the working of 'Link Shim'. So, this bug was accepted and rewarded by facebook.

Now, if you try to use this exploit then it will show error like this.
eg. Try this --->

https://www.facebook.com/dialog/send?app_id=145634995501895&link=http://www.pranavhivarekar.in&redirect_uri=https://ringcloud.com

It will show you error like.

---

This bug was rewarded as it affected other users of Facebook and for pointing exactly about the policy of 'Link Shim'.

About The Author:
You can stay in contact with me(Pranav Hivarekar) on Facebook and can follow me on Twitter. Also, you can check my blog (http://pranavhivarekar.in) for new findings.
Thanks for spending time to read this ...! Comments are welcome. :-)

ANATEL - Brazilian National Telecommunications Agency Hacked

ANATEL - Brazilian National Telecommunications Agency was hacked this week and hackers leaked the database and various information online.

Everything indicates that it is a form of protest against the telephone companies and the country's internet, Marco Civil and Internet freedom.

The hacker who identifies himself as [?] 1NC0GN1T0 [?], Also left a message for telephone operators GVT, Oi, Claro, Vivo, Tim, NET, Embratel and others.

Watch full detail:

ANATEL Hacked & exposed - Ghostbin

MSN.COM Affected By Multiple Flash Cross-Site Scripting Vulnerabilities

MSN.COM Affected By Multiple Flash Cross-Site Scripting Vulnerabilities!

Basically a Flash Cross-Site Scripting Vulnerability isn't so different from the other XSS Attacks and infect they have the same High Impact like the others! but the unique difference is that it works via Flash Object Files (.SWF).

Christian Galeone a youngest cyber security researcher has been found vulnerability in Microsoft domain. He describe as follows:

Into my Bug Hunting Carrier i had the opportunity to find Several High Issues, one of them is the Flash Cross Site Scripting Vulnerability!.

So, here is how it works!:

For these reasons, i have Recently found that the domain " ads1.msn.com " from Microsoft Inc. had Several Vulnerable Flash Objects for this type of Attack!

**Affected URL(s) Link:**

http://ads1.msn.com/ads/7188/0000007188_000000000000000633582.swf

http://ads1.msn.com/ads/76434/0000076434_000000000000000600751.swf

http://ads1.msn.com/ads/83264/0000083264_000000000000000674697.swf

http://ads1.msn.com/ads/60380/0000060380_000000000000000471735.swf

http://ads1.msn.com/ads/73102/0000073102_000000000000000411337.swf

http://ads1.msn.com/ads/68526/0000068526_000000000000000626606.swf

http://ads1.msn.com/ads/76434/0000076434_000000000000000600754.swf

http://ads1.msn.com/ads/53428/0000053428_000000000000000567342.swf

http://ads1.msn.com/ads/9911/0000009911_000000000000000610871.swf

http://ads1.msn.com/ads/65522/0000065522_000000000000000526160.swf

I have downloaded the SWF Object(s) and analyzed their Internal Code with SWFScan (from HP), here you can see the code:

As i saw, the ?ClickTag= Parameter was Vulnerable (after have tested it manually) and so i was able to Inject the PoC Payload Script into it, as you can see below,

Javascript:prompt(document.domain)//

The document.domain indicate where the Script Execution will come from, so the PoC Link will look as below:

http://ads1.msn.com/ads/7188/0000007188_000000000000000633582.swf?clickTAG=Javascript:prompt(document.domain)//

Let's see the main SWF Screen

This is our Result - (Click into the Banner)!

Where about:blank it indicates the Origin of the Script, in our Case the 0000007188_000000000000000633582.swf Object!.

I've then reported the issue to Microsoft Security Team and they decided to Credit me into their Acknowledgement Page for the month of January 2015!

Let's say is an awesome Gift ;-)
Marry Christmas and Happy New Year to Everybody!!

More Details:
http://www.acunetix.com/blog/articles/elaborate-ways-exploit-xss-flash-parameter-injection/

About the Author :
Christian Galeone is a Cyber Security Researcher from Italy, he's currently studying to ITCL Marco Polo ( Vocational Technical Institute | Vo-Tech ) attending the IT Programming Class.
He has been Acknowledged by the TOP 5 Companies including Yahoo!, Microsoft, AT&T, Sony etc.
He is currently working with HOC as author of Cyber Security & Critical Tools Research Articles.

Do you think HTTPS is Secure? But its Not !

Do you think HTTPS is Secure? But its Not !

Do you want to test your Server for BEAST & CRIME Attacks?

Do you want to have an overview on how secure is your encryption also indicating the Supported Suites & Protocols?

TestSSLServer will give you all of them in just one tool!.

All you have to do is visit their main website:

Link: http://www.bolet.org/TestSSLServer/

Then run which package you desire:

-) Java Application

   Link: http://www.bolet.org/TestSSLServer/TestSSLServer.jar

-) Windows Executable Version

   Link: http://www.bolet.org/TestSSLServer/TestSSLServer.exe

Once you will have downloaded it, just drag the app into the Windows Command-Promt and press Enter:

When you are there, you will need to enter the server details, for this use this syntax:

usage: TestSSLServer servername [ port ]

Example: mysubdomain.apple.com 443 **(You can also insert your local address if you have any Server running into it)

As you can see, one of Apple's subdomain is Vulnerable to POODLE Attack since it has SSLv3 Enabled.

It can be attacked from the HTTPS Secure Port - :443 .

We can see that the Vulnerable SSLv3 Cipher Suites are:

RSA_WITH_RC4_128_SHA
RSA_WITH_AES_128_CBC_SHA
RSA_WITH_AES_256_CBC_SHA

...but our Target is also Vulnerable to BEAST Attack as reported below!.

BEAST status: vulnerable

But it's not the end!.

This great Tool also give you relevant informations regarding the Security of your Keys!

My target got it STRONG, it means that a Possible Attacker may concour in some difficulties for Crack the Server Key!.

See Below!:

Minimal encryption strength:    strong encryption (96-bit or more)
Achievable encryption strength: strong encryption (96-bit or more)

If is STRONG, The Hacker may be not facilited but NOT unabilited for CRACK your Web-Server Keys.

At the end, this tool also give you the details about the Security Certificate that the server is running!.

Example mine comes from Cupertino, California!.

Definitively, you should try it at all!.

About the Author :
Christian Galeone is a Cyber Security Researcher from Italy. He has been acknowledged by the TOP 5 Companies including Yahoo!, Microsoft, AT&T, Sony etc.