Search This Blog
Powered by Blogger.

Blog Archive

Labels

Footer About

Footer About

Labels

Load More
Trendy Right Now

Popular Posts

Hacker finds vulnerability in Mr. Robot’s website


A white hat hacker going by the name Zemnmez found the flaw on the new promotional website for upcoming season 2 of Mr. Robot.

Mr. Robot was the biggest 'Hacking Drama' television show of 2015 and its second season will return to American TV screens on July 13, 2016.

The vulnerability could have given Zemnmez an easy way to pawn fans of the show, tricking them into giving over much of their Facebook information. But, shortly after a quick note to Mr. Robot’s writer Sam Esmail, 
the vulnerability was closed off.

The vulnerability known as cross-site scripting (XSS) was discovered on the day when the show launched its promo for the second series. During the launch ceremony, a clip of President Obama was shown condemning a destructive attack launched on the US financial system at the end of the first series, and a website, whoismrrobot.com, mimicking a mix of Linux command line and IRC chat. The series had already received praise for its relatively accurate portrayal of hacking, something other shows and films have failed at miserably.

USA Network’s owner NBC Universal confirmed that the website was patched late Tuesday (May 10) night, hours after Zemnmez reported the flaw.

XSS bugs are widespread. It’s the most common vulnerability class on the web.

If the reporter would have been a malicious hacker, he’d have abused it to steal users’ Facebook information. In particular, he’d have targeted a section of the website that contains a quiz, whoismrrobot.com/fsociety, which requested access to players’ Facebook data. FSociety is the hacktivist collective that central character Elliot Alderson, played by Rami Malek joins early in series one.


Also, the flaw could also be exploited using some simple social engineering technique like phishing to get site victims to click on a malicious link that executes the Javascript code.
Read more »

Qatar Bank Hack Leaks Royal Family, Al Jazeera Data




A massive hack attack on Qatar National Bank has taken the Gulf country by storm leaking the names, bank passwords and other sensitive data of the Qatari royal family members, alleged intelligence agents and Al Jazeera staff.

Qatar National Bank said it was investigating 'an alleged data breach' after a file that appears to contain account information began circulating online.

The 1.4GB file contained names, phone numbers, bank accounts and passwords, payment card data, PINs and other sensitive information of customers of the bank.

(pc- google images)
The data dump had nine main folders named “Al Jazeera”, “Al-Qardawi”, “Al-Thani”, “Banks, corporations”, “Defence and etc”, “Gov”, “Mukhabarat”, “Police, Security” and “Spy, Intelligence”.

The  “SPY, Intelligence” folder included an array of records listed as Ministry of Defense, MI6 (the British intelligence agency) and Qatar's State Security Bureau known as Mukhabarat.

The newspaper said the MI6 file is found next to similar files relating to Polish and French intelligence and contains the in-depth report of alleged agents including the names of close relatives, phone numbers, credit card information and social media accounts.

A number of Al Jazeera staff said that the data found in their section of the leak is mostly accurate. Al Jazeera reporter, Bernard Smith, said,“The details they had for me were mostly correct – I had changed my credit cards just a few months ago after losing them, but other information such as my passwords and contact details were all accurate. I was very shocked to see my details online.”

The Qatar National Bank has released a statement saying that the leak had no financial impact on their clients or the bank, and that they are investigating the matter “in coordination with all concerned parties.”




Read more »

ISIS hackers come together form CCA

Various ISIS hackers have made an association, and have been vigorously infiltrating online sites by posting messages telling highly of ISIS joining hands . This merger is being done with Telegram, one of the very much prefered  channel of ISIS hackers. 

According to the message posted along with on Telegram, the name of the merged hacking group would be United Cyber Caliphate . The groups merging in Caliphate are key hacking unit of ISIS; CCA (Cyber Caliphate Army); and certain pro  -ISIS teams - KTN (KAlacnikov.TN ) and SCA (Sons Caliphate Army ). 

In March, CCA hacked into one Indian SEO company named Add Google Online, and later on boasted that it had hacked actual Google.com, various Cyber- intelligence  Organisations like SITE Intel group have been monitoring this United Cyber Caliphate's actions. 

USA is one of the leading enemy of this group as they hacked  into USA's State Department followed with exposing information of 50 employees, exposed details about Saudi Arabia's Ministry of Defense and Aviation's 18,000 employees, and defaced the website belonging to Russian Federal Customs Service. 

UCC while running its anti - Christian propaganda posted one pro - ISIS message on one  Michigan church's website .And in one of the most dangerous data hacks of UCC, the Caliphate uploaded 3,602 very important citizens names along with their addresses. 
Read more »

'Samsung SmartThings System is vulnerable to hacking'

The researchers from the University of Michigan discovered critical vulnerabilities in Samsung's SmartThings automation systems that can allow potential hackers to gain access to your house.

Scientists have uncovered a series of vulnerabilities that allowed them to open electronic locks, change the smart home's vacation settings, and even set off a house's fire alarm with false messages.

The researchers said the attacks were made possible by two intrinsic design flaws in the SmartThings framework that aren't easily fixed. They also said that consumers should think twice before using the system to connect door locks and other security-critical components.

They were able to perform four attacks that allowed them entry to the home or the ability to take over different functions. A lock-pick malware app, disguised as a battery-level monitor, could spy on a user setting a new PIN code for a door lock and sent the PIN code to a potential hacker via text message.

The security flaw stems from the system's alleged complacency to malicious apps that take control of the SmartThings app and hence allow access to these devices.

The platform had a vulnerability called "overprivilege," which means the SmartApps allowed more access to the devices than originally intended, and the devices could be made to do things that they were not programmed to do originally.

The researchers tested SmartThings because of its wide use. The Android app for the system has been downloaded more than 100,000 times.



Read more »

Mystery looms over Clinton's email-id hack

The US's presidential election candidate Hillary Clinton's private email-id was exposed by the  Romanian hacker, has now claimed that he also gained access to to the former Secretary of State's "completely unsecured" server.

In an exclusive interview from a prison in Bucharest, Marcel Lehel Lazar, told NBC News that  "It was like an open orchid on the Internet, there were hundreds of folders."

Last month only United States extradited him to face charges for hacking accounts of many political elites including Gen. Colin Powell, a member of the Bush family, and former Clinton advisor Sidney Blumenthal.

According to the sources  he was escorted to a Virginia jail by FBI agents. The investigators have seen nothing so far to substantiate his claim but that the investigation continues. But still, a former FBI special agent who ran major cyber security probes found his story credible.

"To go on television and admit to a felony you didn't commit seems a little silly," he said.

Seeking this an opportunity the opposition parties charged that national security was compromised and the FBI launched an investigation, Clinton maintained that the server was safe and there were no security breaks.

"It was a lie, clearly, they're a pathological, well-practiced liar," Lazar said.

Clinton's campaign press secretary, Brian Fallon said that,  "There is absolutely no basis to believe the claims made by this criminal from his prison cell".

"In addition to the fact that he offers no proof to support his claims, his descriptions of Secretary Clinton's server are inaccurate. It is unfathomable that he would have gained access to her emails and not leaked them the way he did to his other victims. We have received no indication from any government agency to support these claims, nor are they reflected in the range of charges that Guccifer already faces and that prompted his extradition in the first place," Fallon added. "And it has been reported that security logs from Secretary Clinton's email server do not show any evidence of foreign hacking."

A source close to the Clinton case confirmed to NBC News that the FBI's review of her server logs showed no signs of foreign hacking.

Read more »

APT-an attack can't ignore

An advanced persistent threat (APT) is a set of stealthy and continuous computer hacking processes which often targets a specific entity. 

An APT usually targets organizations or nations for business or political motives.
There are several reasons for why an organisation is attacked.

Either the miscreants are interested in intellectual property or the organisation has strong technology which the attacker is interested in order to execute an infiltration.The third reason could be if the attacker is simply interested in using the organisation's network to attack other companies.

 APT penetrate systems by the number of days vulnerabilities are discovered relative to the time in which it has been exploited. Zero-day exploits take advantage of unknown vulnerabilities in software.

The vulnerability is essentially discovered on the same day as the APT, day zero. Half day refers to exploits that take advantage of software vulnerabilities that are known to the vendor, but haven’t been patched.

These actors spend significant resources researching popular and company specific software as well as supply chain solutions, looking for vulnerabilities that can be exploited for zero-day and half-day attacks. They later make use of these vulnerabilities to target a specific company or sell it on the black market to the highest bidder.
But it happens because security tools are not programmed to find these exposures. Attacks using these techniques go undetected for months, giving attackers ample time to fortify their access into your network.
We can take the example of Banking, Financial services and Insurance sector.
This sector does vulnerability assessment and penetration testing only as compliance not for real security.
Banks mostly often tell Vulnerability Assessment and Penetration Testing (VAPT) vendors only what server needs to be tested. Banks perceive only those servers as threats. But banks should allow consulting companies to come up with a list of what they think is attack surface area and discuss with the banks before they go ahead to do VAPT.
Moreover, the  patching is seldom done. Companied don't patch their servers saying they are going live for years, though they should be patched in every three months.

The only solution left is to for a company to have an independent cyber security penetration testing which should be done at regular basis.

Most APT attacks on banks could be done using custom spyware which is delivered to end desktop machines. Other bank branches have email ids and Foreign cells which handle SWIFT and other transactions.

SWIFT code is a unique identification code for particular banks which is used when transferring money between banks, particularly for international wire transfers.
When banks go for vulnerability assessment, Banks should look into these attacks.
At times APT attacks are never detected for months despite SOS running with all tools.
Continually testing the security posture of IT infrastructure can be the basic method to keep an eye on.

Security experts believe defence in depth protection which can help organisations protect themselves. Defence in depth covers aspects such as staff and contractor vetting, effective access management, defined compartmentalisation of key information assets and monitoring controls. Security heads should involve other relevant functions across the organisation, such as physical security, HR, fraud and operational response teams. 

Read more »

Japan loses its satellite

Japanese satellite, Astro H or the ultra high tech Hitomi got destroyed after it disintegrated in orbit, torn apart when spinning out of control.

Hitomi was supposedly communicating well with the Earth team but the Japan Aerospace Exploration Agency (JAXA) said that they lost contact on March 26 after a series of attitude control failures caused the satellite spin up and shed critical segments of its solar panels.

At first, it made ground contact but then disappeared and never got in touch since then.

Though investigation is going on in the matter but preliminary analysis points towards poor data in software package which was pushed shortly after an instrument probe was extended from the rear of the satellite.

The Japanese space agency, JAXA not only lost USD 286 million but also three years of planned observations and around 10 years of scientific research.

Space scientists desperately worked to recover the satellite not knowing the extent of the failure. The space agency had assigned 40 technicians to conclude the case and locate the spacecraft. But later on April 28 it ceased efforts to rescue the satellite which was launched two months before.

"JAXA has also received information from several overseas organizations that indicated the separation of the two solar array paddles from Astro-H,” the agency said in a statement. “Considering this information, we have determined that we cannot restore the Astro-H’s functions,” added the agency.
JAXA is now working to determine the reasons for the failure.

On March 26th, the satellite completed a maneuver to point at the galaxy Markarian 205. The Attitude Control System (ACS) began using the Star Tracking (STT) system data to control the position of the satellite. The STT at this point should have updated another position monitoring system, the Inertial Reference Unit (IRU). This may not have occurred.

Hitomi was passing through south Atlantic anomaly at this time and the belts of radiation encircling the Earth dip low in this region so particle density is higher than in other parts of the orbit. High energy particles may have disrupted the onboard electronics.

The satellite was placed in a communications blackout region which barred active ground monitoring of the situation. If human intervention would have been there, the catastrophic failure could have been prevented.
Hitomi was successfully launched on February 17, 2016 on a mission designed to last at least three years.
JAXA collaborated along with NASA with an aim to study black holes and giant galactic clusters, the largest structures in the universe.

Hitomi carried a suite of instruments sensitive to a wide range of energies on the electromagnetic spectrum, from soft X-rays around 300 electron volts to soft gamma rays up to 600,000 electron volts. For comparison, visible light photons are measured around 2 or 3 electron volts.

Such high-energy light beams do not penetrate Earth’s atmosphere which means the X-ray universe is only observable by sending a satellite into orbit. X-ray telescopes allow observations of black holes, which form in the aftermath of violent supernova explosions, and large-scale structures of the universe.

Hitomi carried a NASA-developed X-ray spectrometer to measure the composition and velocity of super-heated matter surround black holes. Astronomers expected the detector to send back data about the complicated environment around the compact skeletons of stars.

NASA had earlier collaborated with Japan to launch the instrument on an X-ray observatory in 2000, but that mission was lost in a launch mishap. Japan’s follow-up X-ray telescope launched with a replacement NASA-built spectrometer in 2005, but the sensor failed before collecting science data.

The science team behind micro calorimeter technology now has to contend with another failure.


It is still impossible for humans to directly observe black holes, but some theories say that they are huge stars which collapsed producing enormous gravitational pull too strong to escape from.
Read more »

Bangladesh Bank Attackers Hack SWIFT



(PC-google images)

British defence contractor BAE Systems has claimed that bank hackers in Bangladesh targeted a software from SWIFT, a key part of the global financial system.

SWIFT or Society for Worldwide Interbank Financial Telecommunication, is an organization owned by 3,000 financial companies is a global financial network that banks use to transfer billions of dollars every day. 

Swift spokeswoman Natasha Deteran said that it has released a software update to thwart the malware, along with a special warning for financial institutions to inspect their security procedures.
The group said its network and core messaging services were not affected.

“Swift is aware of a number of recent cyber incidents in which malicious insiders or external attackers have managed to submit Swift messages from financial institutions’ back offices, PCs or workstations connected to their local interface to the Swift network,” the group warned customers.

BAE published its findings in a blog post on malware that thieves used to cover their tracks and delay discovery of the heist. 

The blog said that, "This malware appears to be just part of a wider attack toolkit and would have been used to cover the attackers' tracks as they sent forged payment instructions to make the transfers."

BAE said it could not explain how the fraudulent orders were created and pushed through the system.
The cyber criminals tried to make fraudulent transfers totaling $951 million from the Bangladesh central bank's account at the Federal Reserve Bank of New York in February.
Read more »

Cyberspies abuse Windows Hotpatching system for malware stealth

A cyber espionage group active in South and Southeast Asia has been leveraging a Windows feature known as ‘hotpatching’ in order to better hide its malware from security products.

Hotpatching is a feature first shipped by Microsoft with Windows Server 2003 to allow the installation of updates without having to reboot or restart a process. The feature was removed in Windows 8 and later versions, because it was rarely used. During the 12 years support life of Windows Server 2003, only 10 patches used this technique.

Malware researchers from Microsoft have code named the group as ‘Platinum’ and claim its existence since at least 2009.
The group has primarily targeted government organizations, defense institutes, intelligence agencies and telecommunications providers in South and Southeast Asia, especially from Malaysia, Indonesia and China.

The group has gone to great lengths to develop covert techniques that allow them to conduct cyber-espionage campaigns for years without being detected.
To achieve this, it only launches a small number of attack campaigns every year. Its custom malware components have self-deletion capabilities and are designed to run only during the victims' working hours, to hide their activity among regular user traffic.
 So far the group has used spear phishing fraudulent emails that target specific organizations or individuals as its main attack method.
Microsoft’s Windows Defender Advanced Threat Hunting team, known as hunters discovered that the information stolen by the group has been used for indirect economic advantages instead for direct financial gain.

Researchers warned in 2013 that hotpatching, which requires administrator permissions, can be abused for malicious purposes, but Microsoft says this is the first time the technique has been observed in the wild.

The researchers also stated “the group shows traits of being well funded, organized, and focused on information that would be of most use to government bodies."

The potential use of hotpatching as a stealth way to inject malicious code into running processes was described by security researcher Alex Ionescu at the SyScan security conference in 2013.

This is the first time that the Microsoft researchers have seen the technique used in the wild by malicious attackers.
Read more »

Banking and Insurance sectors worst hit by ransomware in India


Cyber Security Privacy Foundation Pte. Ltd, a Consulting, Services and Training Company based in Singapore had released a chart on Saturday (April 30) showing how much amount of each sector hit by ransomware in India.

Ransomware is a malware which restricts access to the infected computer system in some way, and demands ransom from the user to remove the restriction.

The consulting company which has its non profit branch operating in India took into account the dataset of 60 companies all over India and found that banking and Insurance sectors were the worst hit by ransomware by 30 percent each.

Pharmacy sector stands second with 20 percent of attacks and the least affected is manufacturing sector among other sectors with 10 percent attacks each.

The database all showed that maximum numbers of computing devices were hit by the attacks in insurance sector which stood at 10 devices while eight devices of banking sector and three of pharmacy firms were affected by ransomware attacks.

The companies taken as a sample had all the standard defenses including antivirus, firewall and other measures still the ransomware succeeded in harming the sectors.


Read more »

Cyberspies abuse Windows Hotpatching system for malware stealth


A cyber espionage group active in South and Southeast Asia has been leveraging a Windows feature known as ‘hotpatching’ in order to better hide its malware from security products.

Hotpatching is a feature first shipped by Microsoft with Windows Server 2003 to allow the installation of updates without having to reboot or restart a process. The feature was removed in Windows 8 and later versions, because it was rarely used. During the 12 years support life of Windows Server 2003, only 10 patches used this technique.

Malware researchers from Microsoft have code named the group as ‘Platinum’ and claim its existence since at least 2009.

The group has primarily targeted government organizations, defense institutes, intelligence agencies and telecommunications providers in South and Southeast Asia, especially from Malaysia, Indonesia and China.

The group has gone to great lengths to develop covert techniques that allow them to conduct cyber-espionage campaigns for years without being detected.

To achieve this, it only launches a small number of attack campaigns every year. Its custom malware components have self-deletion capabilities and are designed to run only during the victims' working hours, to hide their activity among regular user traffic.

So far the group has used spear phishing fraudulent emails that target specific organizations or individuals as its main attack method.

Microsoft’s Windows Defender Advanced Threat Hunting team, known as hunters discovered that the information stolen by the group has been used for indirect economic advantages instead for direct financial gain.

Researchers warned in 2013 that hotpatching, which requires administrator permissions, can be abused for malicious purposes, but Microsoft says this is the first time the technique has been observed in the wild.

The researchers also stated “the group shows traits of being well funded, organized, and focused on information that would be of most use to government bodies."

The potential use of hotpatching as a stealth way to inject malicious code into running processes was described by security researcher Alex Ionescu at the SyScan security conference in 2013.


This is the first time that the Microsoft researchers have seen the technique used in the wild by malicious attackers.
Read more »
Subscribe to: Comments (Atom)