iOS apps vulnerable to HTTP Request Hijacking attacks over WiFi

Security researchers Adi Sharabani and Yair Amit have disclosed details about a widespread vulnerability in iOS apps, that could allow hackers to force the apps to send and receive data from the hackers' own servers rather than the legitimate ones they were coded to connect to.

Speaking about the issue at RSA Conference Europe 2013 in Amsterdam, researchers have provided details on this vulnerability, which stems from a commonly used approach to URL caching.

Demonstration shows that insecure public networks can also provide stealth access to our iOS apps to potential attackers using HTTP request hijacking methods.

The researchers put together a short video demonstrating, in which they use what is called a 301 directive to redirect the traffic flow from an app to an app maker’s server to the attacker’s server.

There are two limitations also, that the attacker needs to be physically near the victim for the initial poisoning to perform this attack and the flaw works only against HTTP traffic.

“A victim walks into Starbucks, connects to the Wi-Fi and uses her favorite apps,” explains an example. “Everything looks and behaves as normal, however an attacker is sitting at a nearby table and performs a silent HRH attack on her apps. The next day, she wakes up at home and logs in to read the news, but she’s now reading the attacker’s news!”

They estimate that at least 10,000 iOS apps in the Apple App Store are vulnerable to the hack. As a result, apps that display news, stock quotes, social media content, or even some online banking details can be manipulated to display fraudulent information and intercept data sent by the end user.

Victims can uninstall apps to scrub their devices clean, and Skycure has released app code that prevents the web caching from taking place. It may be a while until developers can get this fix implemented, so connect to those public networks with extreme caution.

Hackers breach PureVPN website by exploiting a zero-day WHMCS vulnerability

Customers of the Virtual Private network provider "PureVPN" over the weekend started receiving a fake email claiming to be from the founder saying that "due to an incident we had to close your account permanently".

"We are no longer able to run an anonymization service due to legal issues we are facing" The fake email reads.

"We had to handover all customer’s information to the authorities unfortunately. They might contact you if they need any details about the case they are working on. The following information was handed over: your name, billing address and phone number provided during purchase and any documents we had on file (for example scan of your ID or driver’s license if you have provided these to our billing department)."

However, the Co-founder ,Uzair Gadit, said in the official blog post that the email is fake and confirmed the purevpn website hit by a security breach.

Hackers exploited a vulnerability in 3rd party application WHMCS and compromised the email IDs and names of registered users.

"We repeat no billing information such as Credit Card or other sensitive personal information was compromised." The blog post reads.

Vulnerability in WhatsApp allows decrypting user messages

A serious vulnerability in WhatsApp allows anyone who is able to eavesdrop on WhatsApp connection to decrypt users' messages.

Whatsapp, the mobile application for instant messaging platform has become one of the main communication tools of the present day and its popularity makes it attractive for security researchers and hackers.

This time it is debated in the protection of the messages exchanged through the application, thanks to a vulnerability in the crypto implementation they can be intercepted by an attacker.

Thijs Alkemade is a computer science student at Utrecht University in The Netherlands who works on the open source Adium instant messaging project, during its research activity he disclosed a serious issue in the encryption used to secure WhatsApp messages.

In the post titled "Piercing Through WhatsApp’s Encryption" Alkemade remarked that Whatsapp has been plagued by numerous security issues recently, easily stolen passwords, unencrypted messages and even a website that can change anyone’s status.

"You should assume that anyone who is able to eavesdrop on your WhatsApp connection is capable of decrypting your messages, given enough effort. You should consider all your previous WhatsApp conversations compromised. There is nothing a WhatsApp user can do about this but expect to stop using it until the developers can update it." states the researcher.

An attacker sniffing a WhatsApp conversation is able to recover most of the plaintext bytes sent, WhatsApp uses RC4 software stream cipher to generate a stream of bytes that are encrypted with the XOR additive cipher.

The mistakes are:

• The same encryption key in both directions
• The same HMAC key in both directions

Below the trick used by the researcher to reveal the messages sent with WhatsApp exploiting first issue:

WhatsApp adopts the same key for the incoming and the outgoing RC4 stream, "we know that ciphertext byte i on the incoming stream xored with ciphertext byte i on the outgoing stream will be equal to xoring plaintext byte i on the incoming stream with plaintext byte i of the outgoing stream. By xoring this with either of the plaintext bytes, we can uncover the other byte."

The technique doesn't directly reveal all bytes but works in many cases, another element that advantage the attacker is that messages follow the same structure and are easy to predict starting from the portion of plaintext that is disclosed.

The second issue related to the HMAC id more difficult to exploit, Alkemade said WhatsApp also uses the same HMAC key in both directions, another implementation error that puts messages at risk, but is more difficult to exploit.

The MAC is used to detect data alteration but it is not enough to detect all forms of tampering, the attacker potentially could manipulate any message.

"TLS counters this by including a sequence number in the plaintext of every message and by using a different key for the HMAC for messages from the server to the client and for messages from the client to the server. WhatsApp does not use such a sequence counter and it reuses the key used for RC4 for the HMAC."

Alkemade is very critical to the development team of the popular platform:

“There are many pitfalls when developing a streaming encryption protocol. Considering they don’t know how to use a xor correctly, maybe the WhatsApp developers should stop trying to do this themselves and accept the solution that has been reviewed, updated and fixed for more than 15 years, like TLS,” he said.

I agree with the thinking of the researcher, security for applications such as WhatsApp is crucial given its level of penetration, it is true that the interest of the scientific community and cybercrime will surely lead them to discover new vulnerabilities to which WhatsApp have to provide a quick solution.

Alkemade confirmed that there is no remediation for the flaw in this moment, that's why he suggest to stop using WhatsApp until developers produce a patch.

Chinese hackers miss Google network, but the checks go on

Google exec Schmidt says U.S. government networks are in danger 'because no one is there' during the shutdown to stop hackers - See more at: http://www.computerworld.com/s/article/9243040/Chinese_hackers_miss_Google_network_but_the_checks_go_on#sthash.a3ec9xiO.dpuf

 Google exec Schmidt says U.S. government networks are in danger 'because no one is there' during the shutdown to stop hackers.

He put a question to an audience Gartner's Symposium ITxpo here on Monday. "Raise [your] hand if you're sure the Chinese are not inside your corporate network."

Many of the 8,500 attendees were in the hall to hear the question, but only five hands were raised. "Congratulations," Schmidt said from the stage.

Getting more serious, Schmidt lamented the open pathways in corporate networks, letting hackers slip in via NT servers.

Schmidt suggested a better network would eliminate the corporate intranet.

"We're going to have just a network. We're going to make sure that gaining access is application to application," he said.

In an interview on stage with Gartner analysts David Willis and Drue Reeves, Schmidt was asked whether he's sure that Chinese hackers haven't penetrated Google's corporate network.

"We're quite sure they are not right now," said Schmidt of the Chinese, "although every second we check." The audience chuckled.

"I can be quite sure that the Chinese are visiting the U.S. government at the moment because no one is there," said Schmidt, a reference to the federal government shutdown.

Major vendors, and other companies, have faced attacks from China.

Meanwhile, when asked about the security of mobile devices running the Google built Android operating system, Schmidt said "it's more secure than the iPhone."

Eric Schmidt, Google's executive chairman, put a question to an audience Gartner's Symposium ITxpo here on Monday. "Raise [your] hand if you're sure the Chinese are not inside your corporate network."

Many of the 8,500 attendees were in the hall to hear the question, but only five hands were raised. "Congratulations," Schmidt said from the stage.
Getting more serious, Schmidt lamented the open pathways in corporate networks, letting hackers slip in via NT servers.
Schmidt suggested a better network would eliminate the corporate intranet.
"We're going to have just a network. We're going to make sure that gaining access is application to application," he said.
In an interview on stage with Gartner analysts David Willis and Drue Reeves, Schmidt was asked whether he's sure that Chinese hackers haven't penetrated Google's corporate network.
"We're quite sure they are not right now," said Schmidt of the Chinese, "although every second we check." The audience chuckled.
"I can be quite sure that the Chinese are visiting the U.S. government at the moment because no one is there," said Schmidt, a reference to the federal government shutdown.
Major vendors, and other companies, have faced attacks from China.
Meanwhile, when asked about the security of mobile devices running the Google built Android operating system, Schmidt said "it's more secure than the iPhone."
- See more at: http://www.computerworld.com/s/article/9243040/Chinese_hackers_miss_Google_network_but_the_checks_go_on#sthash.a3ec9xiO.dpuf

WhatsApp Website defaced by KDMS team

WhatsApp Defaced Page

 

 

 

 

 

 

 

 

 

 

The Web site of WhatsApp, a widely used messaging app, appeared to have been defaced Tuesday.
The site showed a pro-Palestinian message at 2:40 a.m. PT Tuesday and was given the title "You Got Pwned." A group called KDMS Team claimed credit for the attack.

According to the Whois database, which can be used to see what numeric Internet Protocol (IP) address is assigned to a given Internet domain, the whatsapp IP address record was changed on Tuesday. Such a change, made through the Internet's Domain Name Service (DNS) system, is one way that users who typed in the whatsapp.com name would be redirected to a different Web site.
It wasn't immediately clear if there were any problems with WhatsApp's customer data or services. CNET contacted the company for comment and will update this story with its reply.
WhatsApp is used to send billions of messages a day using mobile apps.

AVG Antivirus and Avira Websites defaced by Palestinian Hackers

AVG Antivirus Hack Screenshot

The Website of Word's most popular Antivirus Firm - AVG were hacked this morning and defaced by a new Palestinian Hacker group - KDMS Team, affiliated with Anonymous Group.

The Defacement page titled 'You got Pwned', with Anonymous Logo and playing Palestinian national anthem in the page background, says: 

we want to tell you that there is a land called Palestine on the earth
this land has been stolen by Zionist
do you know it ?
Palestinian people has the right to live in peace
Deserve to liberate their land and release all prisoners from israeli jails
we want peace and "There Is No Full Security We Can Catch You !"

UPDATE : Another Antivirus Firm 'AVIRA' website also defaced by hackers, just few minutes before.

Avira Website Defaced Page

NETWORK SOLUTIONS, LLC is common Domain Registrar for AVG, Avira and Whatsapp . Possibly, hacker compromised the Domain Registrar and modifies the DNS settings to perform DNS Hijacking.

Researchers Discover 'Hesperbot' - A New and Potent Banking Trojan

 

Security firm ESET has discovered a new and effective banking trojan, targeting online banking users and designed to beat the mobile multi-factor authentication systems.

Hesperbot detected as Win32/Spy.Hesperbot is very identical to the infamous Zeus and SpyEye Banking Malwares and infects users in Turkey, the Czech Republic, Portugal, and the United Kingdom.

Trojan has functionalities such as keystroke logging, creation of screenshots and video capture, and setting up a remote proxy.

The attackers aim to obtain login credentials giving them access to the victim’s bank account and getting them to install a mobile component of the malware on their Symbian, Blackberry or Android phone.

Some other advanced tricks are also included in this banking Trojan, such as creating a hidden VNC server on the infected system and can do network traffic interception with HTML injection capabilities.

The trojan also harvests email addresses from the infected system and sends them to a remote server. It is possible that these collected addresses were also targeted by the malware-spreading campaigns.

 

So far, the Trojan hasn't spread too far. The campaign was first detected in the Czech Republic where the attackers had used phishing emails impersonating the country’s postal service. Armed with this information, the crooks can try to log into victims' online bank accounts to siphon off their cash.

As for the UK, a special variant of the malware has been created, but ESET said it could not provide any further detail on it.

Hacking Facebook to delete any account; Facebook again refuses to pay Bounty

In the past few days, Facebook refused to pay bounty to Khalil Shreateh, the security researcher who used the bug he discovered to post directly on Facebook CEO Mark Zuckerberg’s Timeline after Facebook Security rejected his attempts to report it.

Ehraz Ahmed, an independent Security Researcher claimed that he reported a critical vulnerability to the Facebook Security team, which allows the attacker to delete any account from Facebook.

But Facebook refuses to Pay Bug Bounty, because he tested flaw once on his friend's account, "I reported this bug to Facebook, I'm really not happy with them. After waiting for such a long time for their reply, they denied it saying that you used this bug only works for test accounts, where as I used it for removing real accounts and now the vulnerability is also fixed after their email." he said on his blog.

Vulnerable URL:

https://www.facebook.com/ajax/whitehat/delete_test_users.php? fb_dtsg=AQA1E-WE&selected_users[0]=[Victems Profile ID]&__user=[Attackers Profile ID]&__a=1

Where selected_users[0] and __user parameters are vulnerable to run exploit.

 

Secunia launches the next generation of Complete Patch Management: The Secunia CSI 7.0

Cybercrime costs organizations millions of dollars and to protect business from the consequences of security breaches, vulnerability intelligence and patch management are basic necessities in the toolbox of any IT team, as emphasized by organizations like the SANS Institute and the National Institute of Standards and Technology under the US Department of Commerce (NIST).

The Secunia CSI 7.0 is the Total Package: Vulnerability Intelligence, Vulnerability Scanning with Patch Creation and Patch Deployment Integration.

To help IT teams counter the threat, vulnerability research company Secunia merges the in-house vulnerability expertise with a sophisticated patch management solution into the Secunia Corporate Software Inspector (CSI 7.0). The foundation of the Secunia CSI is a unique combination of vulnerability intelligence and vulnerability scanning, with patch creation and patch deployment integration.

Fake 'Grand Theft Auto V' Torrent Spreads Malware

Excitement continues .. Rockstar Games schedule the release of latest The Grand Theft Auto series, GTA 5 on September 17, but Cyber Criminals has already released a fake version of GTA 5 contains malware on torrent networks.

Romanian security firm BitDefender issued warning that GTA V hasn’t been leaked, and during installation you will be asked to complete a survey and send off a text message to gain the serial number. You will then be charged €1 per day on your phone bill and will be infected by a virus.

The PC version has yet to be announced, so trying to install it on your PC is a ridiculous idea; but that seems to be what a lot of people are doing.

"The survey opens in a web browser and, therefore, is able to perform a geographic redirect to the web page that corresponds to the area you are located in," said, Bitdefender Senior E-Threat Analyst Bogdan Botezatu.

This malware is a generic Trojan Trojan.GenericKDV.1134859, which can steal user information, tamper with system files or draft a computer into a botnet. This will result in you being charged for premium rate text messages sent by bogus firms.

The easiest way to avoid this malicious software is to not illegally download copies of GTA V, especially when the game isn't yet launched.

Code-sharing site GitHub now offers two-factor authentication to its users

Code repository GitHub offers two-factor authentication to beef up security around its users’ accounts. Github is a coding repository where developers used to build their projects projects that may turn out to be valued knowledgeable assets.

Two-Factor Authentication adds another layer of authentication to the login process, Now users have to enter their username and password, and a secret code in the second step, to complete the sign in. If a hacker manages to steal a user's credentials through phishing or trojans, cannot do anything, as they do need a second key to enter.

“We strongly urge you to turn on 2FA for the safety of your account, not only on GitHub, but on other websites that support it,” the company says. This two-factor authentication for Githu can be turned on in your account settings.

GitHub hit 3.5 million users’ landmark along with 6 million repositories deposited on its 5th anniversary in April. Two-factor authentication can protect you from phishing attacks, where hackers try to trick you into giving over your information.

For receiving the second authentication factor, users can either choose to receive it via a text message or can use dedicated authentication mobile app i.e. Google Authenticator for Android/iPhone/BlackBerry or Duo Mobile for Android/iPhone or Authenticator for Windows Phone 7.

Fear of NSA PRISM : Indian Government may ban US email services for official communication

The Indian Government is planning to ban the use of US based email services like Gmail for official communications to increase the security of confidential government information.

The recent disconcerting reports that that India was being spied upon by American intelligence agencies has opened an all new chapter in the cyber security space. As leaked by former US National Security Agency contractor Edward Snowden, that NSA involved in widespread spying and surveillance activities across the globe.

The Government plans to send a formal notification to about 500,000 employees across the country, asking them to stick to the official email service provided by India's National Informatics Centre, Time of India Reported.

The fact that several government officers in top positions use their Gmail IDs for official communications i.e. Several senior government officials in India, including ministers of state for communications & IT Milind Deora and Kruparani Killi, have their Gmail IDs listed in government portals as their office email.

Last week, India's IT minister Kapil Sibal revealed that the new policy will enforce rules such as use of static IP addresses, virtual private networks and one-time passwords for accessing Indian government email services on all Indian officials who are stationed abroad.

“All Indian missions will use NIC servers which are directly linked to a server in India and that will keep government information safe.” Sibal said.

Anonymous injected DDoS to Yahoo & WWE, It’s time to help Syria anonymous says

Yesterday Afternoon, World Wrestling Entertainment website (wwe.com) was taken down by Anonymous hackers,they took down the website to raise awareness about the Syrian civil war.
One of the Anonymous hacker tweeted about this which reads:
World Wrestling Entertainment Down http://www.wwe.com/  Time To HELP SYRIA By #Fr0styFr0ze #OpSyria #Anonymous
Similar tweets show the claims of Anonymous & an Individual hacker to take down groups.yahoo.com, breach onto American Choral Directors Association and leak 600+ Login details (Hack Read reported)

Tweets Regarding the claims under #OpSyria:

Anonymous Indonesia 
Yahoo! Groups Down http://groups.yahoo.com/  #OOPS Its Time To HELP SYRIA By #Fr0styFr0ze

Anonymous Indonesia @AnonNewsIndo

#Fr0styFr0ze #Hacked American Choral Directors Association And Leaked Their database | http://tinyurl.com/m88vqqf

The wwe website was back online within an hour and right now working fine.

Apple Patents Tech Allowing Cops To Remotely Switch Off Their Devices

Recently, The Social Media is buzzing over reports that Apple has invented a new technology that now can Switch off iPhone Camera and Wi-Fi, when entering a 'sensitive area'. Technology would broadcast a signal to automatically shut down Smartphone features, or even the entire phone.

Yes ! It's true, On June 2008 - Apple filed a patent (U.S. Patent No. 8,254,902) - titles “Apparatus and methods for enforcement of policies upon a wireless device” that defines the ability of U.S. Government to remotely disable certain functions of a device without user consent.

All they need to do is decide that a public gathering or venue is deemed sensitive and needs to be protected from externalities. Is it not a shame that you can't take a photo of the police officer beating a man in the street because your oppressive government remotely disabled your Smartphone camera? Civil liberties campaigners fear it could be misused by the authorities to silence 'awkward citizens'.

Apple insists that the affected locations are normally cinemas, theaters and concert grounds, but Apple admits it could also be used in covert police or government operations that may need complete blackout conditions. 

"This technology would be a dangerous power to place in the hands of the government," Kurt Opsahl, a civil liberties lawyer at Electronic Frontier Foundation (EFF). "The government shutting down iPhone cameras and connectivity in order to prevent photos of political activity or the organization of the event would constitute a prior restraint on the free speech rights of every person affected, whether they're an activist or an observer" he added.

Apple also says that the user can be given a choice to approve changes being sent remotely, however one cannot rule out the possibility of some changes being applied to the device without user consent.

China hit by DDoS attack causes Internet inaccessible for hours

During the weekend China's Internet was taken down by a powerful distributed denial of service (DDoS) attack on the .cn domain slowed and blocked Internet access inaccessibility for hours.

Security expert clarified that China could have been perpetrated by sophisticated hackers or by a single individual. The China Internet Network Information Center [CINIC] reported that the attack began at 02:00 local time on Sunday with a peek at 04:00 that made it the largest DDoS attack the country’s networks have ever faced. The CCINIC is responsible for registering sites in the .cn domain.

Before malicious coders can launch a DDoS attack, they must infect the computers of unsuspecting users, often by tricking people into installing malware on their computers.

The China Internet Network Information Center confirmed the attack with an official statement informing internet users that it is gradually restoring web services and that will operate to improve the security level of the Internet infrastructure of the country to prevent and mitigate further attacks.

Following the translated announcement: "8 May 25 at 0:00 or so, the State DNS node Denial of Service attacks, the China Internet Network Information Center disposal, to 2 pm, the service is restored to normal, early morning 3 through the official micro notice. Morning four o'clock, the state once again under DNS node biggest ever denial of service attacks, some websites analytical affected, leading to slow or interrupt access. 

In the notice, the attack continues, national domain name resolution services have been gradually restored. Ministry of Industry and Information Technology launched the "Domain Name System Security specific contingency plans" to further the protection of national domain name resolution services. China Internet Network Information Center, the affected user apologized to launch cyber attacks on the Internet stable behavior affect condemned. China Internet Network Information Center will work with the sector to work together to continue to enhance the service capabilities."

The Wall Street Journal was the first media agency that reported the important outage, the official source of Chinese Government confirmed that its network suffered the biggest distributed denial-of-service attack ever.

It's not currently known who attacked the Chinese domain or the motivations, CloudFlare CEO Matthew Prince said that there is no certainty that behind the attack there is a group of hackers, he added that "it may have well been a single individual".

FBI used Anonymous to attack foreign government systems, claims jailed hacker Hammond

Sentencing for former LulzSec leader Hector Xavier Monsegur, better known as "Sabu" , has again been delayed. Monsegur pleaded guilty to a dozen criminal counts two years prior and stands to face more a maximum sentence of more than 124 years.

Another Lulzsec Hacker Jeremy Hammond has claimed that the FBI used Sabu to coordinate attacks against foreign governments, by Anonymous hackers and Others.

The delays indicate that the FBI is not extracting information from Monsegur and this could mean that the hacker may be helping FBI with other covert operations as Jeremy Hammond claims.

Jeremy Hammond, released a statement on Thursday accusing the US government of asking Monsegur to encourage fellow hacktivists to infiltrate foreign government entities.

“What many do not know is that Sabu was also used by his handlers to facilitate the hacking of the targets of the government’s choosing including numerous websites belonging to foreign governments”, Hammond said.

“What the United States could not accomplish legally, it used Sabu, and by extension, me and my co-defendants, to accomplish illegally”, Hammond added.

"Why was the US using us to infiltrate the private networks of foreign governments? What are they doing with the information we stole? And will anyone in our government ever be held accountable for these crimes?"

Hammond pleaded guilty in May to hacking private intelligence firm Stratfor to expose millions of revelatory emails. The Illinois native faces up to 10 years in prison when he is sentenced, scheduled for 15th November.

Java 6 vulnerable to #0day exploit; added to Neutrino exploit kit

Hackers are using a new exploit for a bug in the out-of-date but popular Java 6 platform to attack victims, and has been added to a commercially available Neutrino exploit kit.

The use of Java 6 still is prevalent, opening up a significant number of users to the threat. F-secure analyst Timo Hirvonen warned about the exploit over Twitter, advising that he had found an exploit in the wild actively targeting an unpatched vulnerability in Java 6, named CVE-2013-2463.

The exploit's proof-of-concept was made public last week, prior to in-the-wild attacks surfacing on Monday. Oracle is aware of the hole but, since Java 6 is no longer supported, the company will not patch the issue.

The vulnerability lies in Java Runtime Environment's 2D sub-component, which is used to make two-dimensional graphics. Because no patch is available, the exploits provides cybercriminals and other attackers an effective vehicle to launch attacks targeting users and organizations using Java 6.

The Neutrino crimeware kit was first spotted in March 2013, when it was identified as the source of a series of attacks that were exploiting Java vulnerabilities to install ransomware on victims' PCs, freezing them until users paid a fine that was supposedly being levied by the FBI and other law enforcement agencies.

The impact of this threat may be less for usual Internet users than for organizations/entities, who may not be quick to migrate to the latest software version due to business and/or operational continuity issues. 

Users should update their Java installations to the latest revision of version 7, which does not suffer from the issue. Users who don’t need Java in their everyday tasks should uninstall the software altogether.

Pinterest Exploit exposes user information of 70 Million accounts

Security researcher Dan Melamed has found a serious Pinterest Exploit that exposed user's information of over 70 Million accounts.

The security researcher Dan Melamed has found a Critical Pinterest Exploit that compromised the privacy of over 70 Million Users, the flaw allows hackers to view the email address of any user on Pinterest.

Pinterest is a very popular social media, over 70 million users including high profile figures and brands that ordinary use it, such a flaw could have a serious impact on their privacy. Dan has found the way to access to the information belonging to the owner of the Access token, as the researcher has shown it is possible to display them visiting the following URL.

https://api.pinterest.com/v3/users/me/?access_token=

MTQzMTYwMjozNTcxOTE5NTE2MDQyNjcxNzc6MnwxMzc3MDY4ODMyOjAtLTE2

ZWJjNDg4NzYxYTFmZWIwZmU0ODcxYzc3ZWUyN2E2YTdhOWNlN2I=

Substituting the "/me/" part of the link with the username of another Pinterest user it is possible to view its email address.

For example the following link shows the email address for user "pinterest" ... try your username , it works!

https://api.pinterest.com/v3/users/pinterest/?access_token=MTQzMTYwMjozNTcx

OTE5NTE2MDQyNjcxNzc6MnwxMzc3MDY4

ODMyOjAtLTE2ZWJjNDg4NzYxYTFmZWIwZmU0ODcxYzc3ZWUyN2E2YTdhOWNlN2I=

A black hat could use the Pinterest Exploit to retrieve all of the email addresses from a list of users for malicious purposes, lets' think for example to a spear phishing attack.

Dan also provided a simple solution to fix the Pinterest Exploit he has discovered, it is sufficient to to check the owner of the access token against the user whose information is being requested, in this way it is possible to prevent any abuse.

Dan Revealed that Pinterest Security Team is very efficient and careful with privacy issues, it has already confirmed that the Pinterest Exploit has been patched. Let's consider that the same Pinterest gave Dan permission to disclose the Pinterest Exploit differently from other company with similar security problems, they also included Dan's name in the Pinterest Heroes List.

Dan Melamed discovered the same type of security flaw in StumbleUpon, the researcher was able to view the full name, email address, age, gender, and location of its users, but the company never gave him permission to disclose the exploit, even after they patched it.

As highlighted by Dan flaws like Pinterest Exploit and StumbleUpon vulnerability would have allowed a hacker to collect over 100 million email addresses, security for social media is a serious issue.

Hacker reported vulnerability in Kaspersky website, Demonstrated malware spreading technique

The cyber Security Analyst  'Ebrahim Hegazy' (@Zigoo0) Consultant at Q-CERT has found an "Unvalidated Redirection Vulnerability" in the website of the giant security solutions vendor "Kaspersky".

Ebrahim, who found a SQL Injection in "Avira" website last month, this time he found a Unvalidated Redirection Vulnerability that could be exploited for various purposes such as:

• Cloned websites (Phishing pages)
• It could also be used by Black Hats for Malware spreading

In the specific case what is very striking is that the link usable for the attacks is originated by a security firm like Kaspersky with serious consequences.

Would you trust a link from your security vendor? Absolutely Yes! But imagine your security vendor is asking you to download a malware!

To explain how dangerous the situation is when your security vendor is vulnerable, Ebrahim Hegazy sent me a video explaining the malware spreading scenario to simulate a Black Hat's exploiting Unvalidated Redirection Vulnerability in Kaspersky website to serve a malware.

"Since I'm working on Cyber security analysis, I've seen many methods of black-hats to spread links, maybe this link is for Exploit kits, Java Applet, flash exploits, or maybe a direct link to their EXE file. Let's take an example on the Facebook spreading techniques of the attackers, you may notice that "Mediafire" website was used lately in wide Malware spreading attack on Facebook.com,Which caused a wide infection, as the infected user will start to send links from Mediafire.com to his friends and since "Mediafire" is a trusted website/source for users so they simply click it and download the file!

But what if the links are coming from a very well known Security solutions vendor such as Kaspersky? For sure people will trust the links. So, through "Unvalidated Redirection Vulnerability" in Kaspersky, attackers will be able to spread a link coming from Kaspersky.com but when the user clicks on that link, he will get redirected to the attacker's website which would download at Malware on their machines or even download a "Rogue Antivirus" to steal financial information such as credit card information!" explained Ebrahim Hegazy.

After the researcher reported the vulnerability to Kaspersky team, it took about 2 months to fix the vulnerability, it is really a long time considering that if a hacker had found this flaw before Hagazy he could spread links using Kaspersky.com.

The consequences of unfixing of such vulnerability are critical

• Wide infection - since the redirection is coming from a trusted source especially if the attacker registered a domain name similar to Kaspersky.com
• Very bad reputation for Kaspersky company.
• Your most trusted resource "Your Antivirus" will be your worst enemy! Would you trust anything else!

After FBI says “We have Dismantled Anonymous”, Anonymous hacked FBI to show the presence

FBI says that they have dismantled the Anonymous group of hackers because most of its “largest players” have been arrested by US law enforcement authorities.
But Anonymous hackers don’t think like this, to prove them wrong and to show their presence, Anonymous group of hackers dumped large amounts of data that appears to have been stolen from FBI servers.
After the leak assistant special agent in charge of the FBI’s cyber division told :

“The movement is still there, and they’re still yacking on Twitter and posting things, but you don’t hear about these guys coming forward with those large breaches
“It’s just not happening, and that’s because of the dismantlement of the largest players,” he added.
“Has anyone seen my leg? I’m in pieces over here!” tweeted one Anonymous-affiliated account. “SHOUTOUTZ TO ALL TEH DISMANTLEZ CREWZ OUT THERE IN SCARED OF TEH FBI LAND LOLOLOLOL,” tweeted @OpLastResort, an account managed by Anons closely associated with the collective’s most recent hacks.

Leaked data consist personal information and some confidential information also, below is the screenshot of the leak:

 

After the Anonymous hackers reply to FBI, let’s see what will they do to stop them, will FBI arrest more anonymous members and will say again “We have dismantled the Anonymous” let’s see.