Hack on Omid Farhang

What you need to know about BERserk and Mozilla

Thu, 25 Sep 2014 22:10:46 +0000

The Intel Security Advanced Threat Research Team has discovered a critical signature forgery vulnerability in the Mozilla Network Security Services (NSS) crypto library that could allow malicious parties to set up fraudulent sites masquerading as legitimate businesses and other organizations.

The Mozilla NSS library, commonly utilized in the Firefox web browser, can also be found in Thunderbird, Seamonkey, and other Mozilla products. Dubbed “BERserk”, this vulnerability allows for attackers to forge RSA signatures, thereby allowing for the bypass of authentication to websites utilizing SSL/TLS. Given that certificates can be forged for any domain, this issue raises serious concerns around integrity and confidentiality as we traverse what we perceive to be secure websites.

Iranian Hackers targeting US oil, gas, and electric companies

Sun, 26 May 2013 19:50:30 +0000

The Hacker News reported: For all the talk about China and the Syrian Electronic Army, it seems there’s another threat to U.S. cyber interests i.e. Iran. Series of potentially destructive computer attacks that have been targeting American oil, gas and electricity companies tracked back to Iran.

Iranian hackers were able to gain access to control-system software that could allow them to manipulate oil or gas pipelines. Malware have been found in the power grid that could be used to deliver malicious software to damage plants. The targets have included several American oil, gas and electricity companies, which government officials have refused to identify.

LulzSec Hacker Gets A Year For Sony Hack

Sat, 20 Apr 2013 19:47:19 +0000

A former LulzSec hacker has been jailed for a year for ransacking Sony Pictures Entertainment’s computer systems.

Cody Kretsinger, 25, from Decatur, Illinois – better known to his fellow LulzSec cohorts as “Recursion” – was also ordered to carry out 1,000 hours of community service, and a year of home detention, following his release from prison.

He was sentenced by a Los Angeles court on Thursday, Reuters reports.

Kretsinger had pleaded guilty to a single count of conspiracy and unauthorized impairment of a protected computer (i.e. computer hacking) in a plea-bargaining agreement. Kretsinger admitting breaking into the Sony Pictures website and extracting information which he passed on to other members of LulzSec, who leaked the data in order to embarrass Sony, a hated enemy of the hacktivist group.

Anonymous-linked groups hack Israeli websites, release personal data

Mon, 25 Mar 2013 10:42:00 +0000

An anti-Israel hacking collective affiliated with Anonymous says it has initiated a widespread cyber attack against the Jewish state, penetrating websites affiliated with the Mossad security service and a slew of related entities.

The hackers claimed late Friday that they have obtained and released personal information relating to 35,000 Israeli government officials, including politicians, military leaders, and police officers, according to a Twitter feed associated with the hackers.

A comprehensive spreadsheet purporting to include the information of all 35,000 Israeli officials was published by the website Cryptome, though it did not independently verify the information.

Emma Stone’s twitter hacked

Mon, 25 Mar 2013 10:24:00 +0000

3/22/2013: Emma Stone revealed that she was not behind the ambiguous tweets concerning boyfriend Andrew Garfield and co-star Shailene Woodley that sparked cheating rumors.

Speculation surrounded Stone’s mysterious “tweet and delete” spree over the past few months.

Emma addressed the rumors on an On Air with Ryan Seacrest radio interview.

One tweet in particular on her Twitter appeared to be an anagram that solved to read, “Andrew and Shailene sitting in a tree.”

Evernote is suspect of a hack, change your password

Sat, 02 Mar 2013 20:23:00 +0000

Cross-posted from Evernote blog:

Evernote’s Operations & Security team has discovered and blocked suspicious activity on the Evernote network that appears to have been a coordinated attempt to access secure areas of the Evernote Service.

As a precaution to protect your data, we have decided to implement a password reset. Please read below for details and instructions.

In our security investigation, we have found no evidence that any of the content you store in Evernote was accessed, changed or lost. We also have no evidence that any payment information for Evernote Premium or Evernote Business customers was accessed.

Facebook Got Hacked Last Month and Is Just Telling You Now

Fri, 15 Feb 2013 22:53:00 +0000

Cross-posted from Gizmodo:

Facebook just announced that it was hacked last month in a short statement on its website. Apparently, an unknown number employees visited a compromised developer site and were infected with malware. Facebook’s being very cagey about all this, but we’ve been able to scrounge up some details.

According to the statement, the company reacted swiftly with an investigation and remediation following the “sophisticated attack.” The company won’t say which law enforcement agencies it’s working with. It claims no user data was compromised.

1 million Apple Device IDs leaked, claim hackers

Tue, 04 Sep 2012 13:02:00 +0000

According to the AntiSec hacker group, they claim to hold more than 12 million Apple iOS Unique Device IDs, in addition to other personal information from device owners. As a move to back up such a claim, the AntiSec hacker group is said to have released slightly more than a million Apple Device IDs to the masses. This particular expose was unveiled on Pastebin, which is said to hold a detailed description of the method that the hacking group were said to have obtained the IDs from the FBI.

AMD Blog Hacked, Database leaked on Internet

Mon, 20 Aug 2012 12:00:00 +0000

TheHackerNews: A team of Hackers called, “r00tBeer Security Team” today hack into official blog of Advanced Micro Devices (AMD) which is a American multinational semiconductor company. AMD is the second-largest global supplier of microprocessors based on the x86 architecture and also one of the largest suppliers of graphics processing units.

Hacker deface the blog page (http://blogs.amd.com/wp-content/r00tbeer.html) [Dead Link – Screenshot blow] and also leak the complete user database of blog on his twitter account. Leaked database SQL file uploaded on Mediafire by Hackers which include 200 AMD user’s Emails, WordPress Blog Usernames and Passwords.

Bogus anti-hacking tool targets Syrian activists

Sun, 19 Aug 2012 09:01:00 +0000

h-online: Syrian activists, journalists and opposition group members are reportedly under attack by malware claiming to be a security tool that will help protect them against hackers. The fake “AntiHacker” tool is being spread through targeted phishing emails and via sites such as Facebook, and claims to provide “Auto-Protect & Auto-Detect & Security & Quick scan and analyzing” functionality.

Anonymous hackers identify charity attacker

Thu, 02 Aug 2012 20:37:00 +0000

BBC: Hacking group Anonymous has aided a global search for a cyber-vandal who defaced a charity website.

Members of Anonymous helped track the attacker down to Madrid following a plea from the owner of the RedSky video production company.

New Zealand-based RedSky asked for help after an attacker penetrated its website, erased data and left graffiti.

The attack was reportedly carried out in a bid to impress Anonymous and join its ranks as a member.

Cloud service cracks VPN passwords in 24 hours

Tue, 31 Jul 2012 16:17:00 +0000

h-online: At the Black Hat hacker conference in Las Vegas, encryption expert Moxie Marlinspike promised that his CloudCracker web service was able to crack any VPN or WiFi connection secured using MS-CHAPv2 within 24 hours. The cost? Around $200.

MS-CHAPv2 is based on the eminently crackable encryption algorithm DES. The problem was first documented in 1999 by Bruce Schneier working with two other researchers. A large number of processor cores are still required to crack the encryption within a reasonable time – the number of possible keys makes trying to perform a brute force attack on a normal PC a hopeless task.

Password leak at meetOne

Thu, 26 Jul 2012 14:21:00 +0000

h-online: A data leak at the meetOne dating site allowed anyone to access private data including the plaintext passwords, email addresses and real names of the site’s approximately 900,000 members. To obtain the data, an attacker simply needed to increment a URL parameter. After they were informed by The H‘s associates at heise Security, the operators soon closed the hole.

When news of a data leak in one of the dating portal’s custom APIs was disclosed to heise Security, the editors managed to reproduce the problem and access the data of a specially created test profile. The API disclosed information including the email address and password of the test user, which allowed access to the user’s profile.

Brit accused of biggest military hack in history

Wed, 25 Jul 2012 21:36:00 +0000

iol scitech: London – A British computer hacker accused by the United States of breaking into top secret military and space agency networks will learn the result of his six-year fight against extradition within three months, a court heard on Tuesday.

Gary McKinnon faces up to 60 years in jail if convicted in American courts for what one US prosecutor has described as the “biggest military computer hack of all time”.

Anonymous hackers cripple Australian gov't websites

Tue, 24 Jul 2012 19:27:00 +0000

FoxNews: International hacking group Anonymous took at least 10 Australian government websites offline briefly Tuesday in a series of escalating attacks over proposed changes to privacy laws.

The Australian arm of the group has warned it will continue the attacks on “.gov.au” sites until plans to force ISPs to store user data and make it further available to security services are shelved.

The attacks started after Prime Minister Julia Gillard answered policy questions via webcam in an online Google+ Hangout session on Saturday but the sites targeted so far are all run by the Queensland State Government.

11 million passwords leaked from online gaming platform

Tue, 24 Jul 2012 19:06:00 +0000

h-Online: A file with 11 million password hashes belonging to users of the online games platform Gamigo has been circulated on the internet. According to an analysis by ZDNet, 8.2 million different email addresses are also part of the 478MB file. Around 3 million of these belong to users from the US, 2.4 million are German addresses and 1.3 million are supposed to originate in France. The list also includes corporate email addresses from companies such as IBM, Siemens, Deutsche Bank and the German insurance company Allianz.

Aguilera: Hacker Stole My "Feeling Of Security"

Thu, 19 Jul 2012 22:47:00 +0000

The Smoking Gun: Christina Aguilera contends that the recent hacking of her e-mail account had stripped her of a “feeling of security” that now “can never be given back,” according to a victim’s impact statement submitted to a U.S. District Court judge in Los Angeles.

The singer’s statement was prepared in advance of the sentencing of Christopher Chaney, the Florida felon/online stalker who has pleaded guilty to illegally accessing the e-mail accounts of more than 50 victims (many of them Hollywood figures).

NVIDIA hackers publish user data

Mon, 16 Jul 2012 19:53:00 +0000

Late last week, NVIDIA confirmed that the database for its forums web site had been broken into by unauthorized third parties, with data from more than 400,000 registered users affected. A hacker group calling itself “Team Apollo” has now claimed responsibility for the breach which caused NVIDIA to take the site down.

As proof, they have published email addresses and password hashes for approximately 800 users from the database on Pastebin, with more, apparently, to follow. If the data proves to be genuine, NVIDIA’s statement that the password hashes were salted would be contradicted: the database excerpt includes the hash b018f55f348b0959333be092ba0b1f41 three times in the list, the result of md5('nvidia123').

Android Forums hacked: 1 million user credentials stolen

Fri, 13 Jul 2012 09:08:00 +0000

ZDNet: Phandroid’s AndroidForums.com has been hacked. The database that powers the site was compromised and more than 1 million user account details were stolen. If you use the forum, make sure to change your password asap.

Read the whole story at ZDNet: http://www.zdnet.com/android-forums-hacked-1-million-user-credentials-stolen-7000000817/

Yahoo! Voice reportedly compromised, over 453,000 credentials exposed

Thu, 12 Jul 2012 08:39:00 +0000

Übergizmo wrote: If you use Yahoo! Voice a lot – Yahoo’s VoIP service via its Yahoo! Messenger instant messaging application, then you will definitely need to hear this report. Earlier today, more than 453,000 user accounts from an unidentified service owned by Yahoo were posted on a hacker site. The hackers reportedly said that they infiltrated the subdomain by using a union-based SQL injection. But the group responsible for the security breach added that the data breach was intended to be a wake-up call for Yahoo.