Search This Blog

Powered by Blogger.

Blog Archive

Labels

Footer About

Footer About

Labels

Google Malaysia website hacked by TeaM MADLEETS via DNS hijacking




Pakistani hackers from a group called "TeaM MADLEETS" has defaced the home page of Google Malaysia with a message saying ""Google Malaysia STAMPED by PAKISTANI LEETS".

It appears hackers defaced the domain(google.com.my) using DNS hijacking attack- Hacking into Domain provider and modifying the DNS records.

The hackers managed to change the name server details of the website : Primary Name Server to "b0x4.madleets.com " and secondary name server to "b0x3.madleets.com".

"We feel we need to alert anyone, that we don't hack any country tlds for example google.com.my as a result of any kind of hate, We don't hate anyone, We love all humanity, there is no obvious reason for stamping the tlds.
Least the reason is not any kind of hate.Whatever the reason is we can't explain except we love all of you." The hackers posted the message in their facebook page.


Vodafone Germany threw confidential customer info into a paper bin on the street


Vodafone Germany has admitted to another data breach.  A partner agency in Kaiserslautern threw documents containing confidential customer information into a paper bin on the street.

Last month Vodafone admits a security data breach in which a hacker gained access to sensitive financial information of at least 2 million of its customers.

Now ,there is again a data breach.  The document reportedly contains information such as customer addresses, bank details, and copies of IDs.

Vodafone has stated that the mistake was made by a temporary employee and that it had informed federal data protection and telecoms authorities.

Hacking attempt by KDMS Team to deface Avast website failed

KDMS Team, the Palestinian hacker group who defaced the websites of Avira, WhatsApp, AVG , is also said to have attempted to hijack Avast website.

Avast realized and thwart the hackers attempt to compromise domain , when they received a notification from Network Solutions saying their email had been changed.

"We knew we had not requested that so we immediately took action and changed our passwords, which protected us" Avast CEO said.

Users and customers of the affected websites no need to worry- No user data is compromised. It is a DNS hijack attack in which hackers break into domain provider and modify DNS records.

Paunch, creator of infamous BlackHole Exploit kit arrested in Russia


A man alleged to be the creator of infamous BlackHole exploit kit has been arrested by Russian authorities.

Maarten Boone, a security researcher at Fox-IT, was the first person who broke the news in his tweet saying " Blackhole exploit kit author 'Paunch' and his partners arrested in Russia".

However, there were no more information from Boone.  Jerome Segura at MalwareBytes pointed out that the encryption service used by Blackhole (crypt.am) is down.

Troels Oerting, head of the European Cybercrime Centre, an arm of Europol, has confirmed to TechWeekEurope an arrest had been made, the details of which were given to the organization.

“I know it is true, we got some information, but I cannot say anymore,” Oerting told TechWeek.

Avira, AVG, Alexa and WhatsApp websites hacked by KDMS Team



The hackers group who defaced the popular hosting website LeaseWeb has once again attacked top websites and left them defaced.

It includes the popular messaging service WhatsApp, top free antivirus AVG, Avira, Alexa(Alexa.net) and Porn website RedTube.

The whois data of the affected domains apparently shows that they are registered with Network Solution.


It appears hackers compromised the domain provider and changed the DNS data rather than attacking individual websites.

At the time of writing, the avira website still shows the defaced page whereas other websites are offline including avg.com.


AVG has confirmed to E Hacking News that "it has had a select number of online properties defaced as a result of our domain name system (DNS) registrar being compromised".

"A number of other companies appear to have been faced with the similar issue. The situation is being further monitored and assessed closely. Customers are our priority, the DNS records have been corrected and AVG is working hard to resume normal service levels to its customer base and continue to protect our customers and their privacy."

Hackers breach PureVPN website by exploiting a zero-day WHMCS vulnerability


Customers of the Virtual Private network provider "PureVPN" over the weekend started receiving a fake email claiming to be from the founder saying that "due to an incident we had to close your account permanently".

"We are no longer able to run an anonymization service due to legal issues we are facing" The fake email reads.

"We had to handover all customer’s information to the authorities unfortunately. They might contact you if they need any details about the case they are working on. The following information was handed over: your name, billing address and phone number provided during purchase and any documents we had on file (for example scan of your ID or driver’s license if you have provided these to our billing department)."

However, the Co-founder ,Uzair Gadit, said in the official blog post that the email is fake and confirmed the purevpn website hit by a security breach.

Hackers exploited a vulnerability in 3rd party application WHMCS and compromised the email IDs and names of registered users.

"We repeat no billing information such as Credit Card or other sensitive personal information was compromised." The blog post reads.

Certified WhiteHat Hacker Training


Cyber Security and Privacy Foundation(CSPF) has launched a new course on Information security named "Certified WhiteHat Hacker (CWHH)", a course that will be helpful for a person to get into the Ethical Hacking world.

Here is our interview with the founder of CSPF ,Mr. J Prasanna:

Why CWHH? 
There are totally 5 Lakhs security professional needed in India. People do a general certification course to get into the InfoSec field.  But most of them lack the tech knowledge needed for cyber security.  There are countable number of whitehat hackers who are at cyber security.  CSPF felt that there is need for creating awareness on cybersecurity and Ethical Hacking practices for students in colleges.

How many levels are in CWHH and can you give more info on that?
CWHH level-I is subsidized course on Ethical Hacking for college students.  It happens in two ways, most often colleges invite us to do the course in their premises;The second method, we announce the course in common place where students of all colleges can register online and do attend the course. 

CWHH level-II focuses on advanced cybersecurity and provides hands on training.

CWHH level-III and CWHH level-IV are for advanced users. It will be imparted to candidates from corporate who have minimum 2 experience in cybersecurity. We will conduct psychometric test to assess ethics of a person.

CWHH level-V is awarded to white hat hackers who are talented by themselves.  It is mostly given to exploit finders and exploit writers.  It is more given as mark of respect.  CSPF  invites applications from such talented experts.

Who will give training?
CSPF has range of trainers who have found vulnerability in top websites and who are in Hall of Fame of major companies including Microsoft, Nokia, Redhat, Yandex, Megaupload, etc.

So, what is ultimate goal of this course?
CSPF's aim from this course to create a real CyberSecurity talent on the country.  We will from time to time take help of all talented security researchers and hackers in this country.

Our first launch course on cwhh is held on Nov 16 in Chennai.
Register here: http://www.meraevents.com/event/39805

LeaseWeb hosting site hacked and defaced by KDMS Team


LeaseWeb, one of the leading hosting providing company, has been breached and defaced by a hacker group named "KDMS Team".

"Who Are you? Who is but the form following the function of what and what are you is a hosting company with no security" The hackers wrote in the defaced page. ""KDMS Team: Well, we can see that :P ".

"Do You know what that means? We owned All of your hosted sites.  Index on your site is the prove ;)" The hackers added.

The company has responded to the security breach saying " Website should be back to normal in a few hours. No customer data compromised. We continue to investigate."

However, hacker posted in facebook saying " No customer data compromised ! sure?! :| investigate ? will you find any thing ?".

Loretto Telecom, The West Australian and Moundville Telephone Co websites hacked by TeamBerserk

A Hacker group named TeamBerserk has claimed to have hacked into Loretto Telecom, The West Australian Newspaper and Moundville Telephone Company websites and leaked data.

Hackers claimed to have exploited a SQL Injection vulnerability in The Western Australian website and gained root access to the entire server.  The breach allowed hackers to access all domains hosted in the server including website of Southern Computer Company.

"After that we get into SCC client base and f***around with their client computers which are running remote services on Windows machines; and some of these clients are AU Government. Thanks for the additional bots and all the #Data.  We'd like to thank The Western Australian for the SQLi and InterVolve Cloud for a very vulnerable set of boxes."  The hackers said.

The group leaked 1,400+ usernames and passwords compromised from Loretto Telecom website and a link to the login page.

"We worked together quite quickly when we exploited and got root to this box. After we got axx we plundered all of the accounts for tens of thousands of digital monies ($), with these monies we purchased BTC and LTC and ordered lots of ** and pizzas to the FBI and DoJ like we normally do when we get lots of booty (YARR)" Hackers wrote next to the leaked data.

The group also claimed to have breached mound.net and gained access to accounts and "purchased tens of thousands of dollars worth of BTC and LTC. Many bank accounts were also completely penetrated and we still have access to these accounts."

Digit9 server compromised by hackers


An unknown hacker claimed to have compromised the server of digit9 - a leader among digital creative agency in Mumbai highly specialized in Web marketing company that markets Movies, Music and Artistes over new age digital mediums.

The screenshots provided by hackers show that they have taken control of the digit9.co.in and compromised the backup files from the server.


The compromised files includes backup file of "Box Office India", backup file of pathshaala and few other files stored in the server.

The hacker also managed to get access to source codes of few files belong to "Films of India".

Silk Road taken down by FBI

Notorious online marketplace "Silk Road" has been taken down by the FBI and the owner "Ross Ulbricht" a.k.a (Dread Pirate Roberts) has been arrested . Proving that "Perfect security is impossible"

He has been charged with  conspiracy to traffic narcotics, conspiracy to hack computers, and conspiracy to launder money.

The website now shows a "This Hidden Site Has Been Seized" message





Silk Road was the drug dealing website in the world .It used the "TOR hidden network" to hide itself and its users.It seems Ross Ulbricht was caught due to his own mistakes and NOT due to a vulnerability in the TOR network.


This site had been a major point used lawmakers and politicians to try to curtail the growth of the TOR
 network.And now the recent actions by the FBI against many hidden sites in the TOR network is indeed a very big setback for it.

All the transactions in silkroad were done using Bitcoins and since the news of Ross Ulbricht's arrest bitcoin value has dropped quite a bit (Due to paranoid selling). But this is just the currency stabilizing itself, when it stabilizes BTC value will rise again. And the removal of association from such illigal market places might actually be a good thing for bitcoins.

Ross Ulbricht's LinkedIn Profile:http://www.linkedin.com/in/rossulbricht
Full Arrest Warrant: http://www1.icsi.berkeley.edu/~nweaver/UlbrichtCriminalComplaint.pdf
Full Details on how he was caught: https://medium.com/p/d48995e8eb5a



Note: I Will update as the story develops . You can tweet me at @SuriyaME   if you have something to add to this article.