Nasty Covert Redirect Vulnerability found in OAuth and OpenID

After Heartbleed bug, a security flaw in widely used open-source software OpenSSL that puts countless websites at risk, another vulnerability has been found in popular authentication software OpenID and authorization software OAuth. Wang Jing, a Chinese mathematics Ph.D student at the Nanyang...

Critical Holes in OAuth, OpenID Could Leak Information, Redirect Users

UPDATE — A serious vulnerability in the OAuth and OpenID protocols could lead to complications for those who use the services to log in to websites like Facebook, Google, LinkedIn, Yahoo, and Microsoft among many others. OpenID and OAuth are commonly used authorization protocols. The protocols ar...

Apple Releases Security Updates for OS X, iOS devices, and Apple TV

Apple has released security updates for Mac OS X, iOS devices, and Apple TV to address multiple vulnerabilities, some of which could allow an attacker to execute arbitrary code, cause application termination, or expose users to covert eavesdropping. Updates available include: Security Update...

Hacking Team sold Spyware to 21 Countries; Targeting Journalists and Human Right Activists

Spying on the world by injecting sophisticated backdoors in software, systems, and mobile phones, leads to violation of the Privacy and Security of every individual. Yes, we are talking about Surveillance, but this time not about NSA. Instead, Countries including some with poor human-rights recor...

'Chaos Computer Club' filed criminal complaint against German government Over Mass Spying

After the revelation of former NSA contractor Edward Snowden, we all very well knew the impact of it on the world, but nobody would have estimated that the impact will be so worst. The revelation, not only defaced NSA, but also its counterpart GCHQ, and various other governments which were servin...

Acoustical Mesh Network Used to Infect Air-Gapped Computers

The soundest security advice managers of critical computing systems have been given is to air gap those machines. Don’t network them and don’t expose them to the Internet, and there’s no way hackers reach them from the Web and no way a direct infection replicates. Recently, there’s been reason fo...

tcp(port&seq) backdoor

Автор: slashd Что это? Реализации скрытого канала передачи данных на сервер с помощью стандартных полейв нашем случае поля SEQ и Source Port TCP-заголовка. Теоритическая часть. Реализовать скрытую передачу данных с помощью TCP-заголовка можно несколькими способами. Клиентхакер иницирующий...

FBI used Anonymous and Lulzsec Hackers to attack foreign governments

Sentencing for former LulzSec leader Hector Xavier Monsegur, better known as "Sabu" , has again been delayed. Monsegur pleaded guilty to a dozen criminal counts two years prior and stands to face more a maximum sentence of more than 124 years. Another Lulzsec Hacker Jeremy Hammond has claimed tha...

FBI used Anonymous and Lulzsec Hackers to attack foreign governments

Sentencing for former LulzSec leader Hector Xavier Monsegur, better known as "Sabu" , has again been delayed. Monsegur pleaded guilty to a dozen criminal counts two years prior and stands to face more a maximum sentence of more than 124 years. Another Lulzsec Hacker Jeremy Hammond has claimed tha...

Multiple vulnerabilities in multiple themes for WordPress with VideoJS

Hello 3APA3A! These are Cross-Site Scripting and Full path disclosure vulnerabilities in multiple themes for WordPress with VideoJS. Earlier I've wrote about vulnerabilities in VideoJS http://seclists.org/fulldisclosure/2013/May/21. This is popular video and audio player, which is used at hundred...

Hidden microphone found in Ecuador's embassy in UK

A hidden microphone was found in Ecuador's embassy in London, where WikiLeaks founder Julian Assange is sheltering from extradition to Sweden, The Ecuadorean Foreign Minister Ricardo Patino claimed. The microphone was found in the office of the ambassador Ana Alban and was discovered last month...

Researchers Use Music, Light to Trigger Mobile Malware

Calling it a paradigm shift, university researchers were able to trigger mobile-device malware using a modest amount of music, lighting, magnetic fields or sound vibrations. “When you go to an arena or Starbucks, you don’t expect the music to have a hidden message, so this is a big paradigm shift...

Ra1NX PHP Bot Authentication Bypass Remote Code Execution

Exploit Title: "Ra1NX" PHP Bot pubcall Authentication Bypass Remote Code Execution Date: March 24, 2013 Exploit Author: bwall Software Link: https://defense.ballastsecurity.net/decoding/index.php?hash=69401ac90262f3855c23cd143d7d2ae0 Version: v2.0 Tested on: Ubuntu require 'msf/core' class...

Ra1NX PHP Bot - pubcall Authentication Bypass Remote Code Execution (Metasploit)

Exploit Title: "Ra1NX" PHP Bot pubcall Authentication Bypass Remote Code Execution Date: March 24, 2013 Exploit Author: bwall Software Link: https://defense.ballastsecurity.net/decoding/index.php?hash=69401ac90262f3855c23cd143d7d2ae0 Version: v2.0 Tested on: Ubuntu require 'msf/core' class...

Beacon : A new advance payload for Cobalt Strike

Raphael Mudge Creator of Cobalt Strike announced Another Advance Payload for Cobalt Strike called "Beacon". In a conversation with The Hacker News Raphael said "A big gap in the penetration tester's toolbox are covert command and control options, especially for long engagements. Beacon is a new...

Report: Iran Claims To Have Hacked, Then Hijacked Stealth Drone

A report on the Web site of the Christian Science Monitor claims that Iran exploited a long-known vulnerability in the GPS navigation system of the U.S.’s RQ-170 Sentinel drone to force it into landing safely within Iran. The report, Thursday, cites an Iranian engineer that is part of a team that...

US ,Israel or Russia , Who is Behind Stuxnet?

US ,Israel or Russia , Who is Behind Stuxnet ? Initially After Symantec did a little reverse engineering on the now infamous Stuxnet worm, many started pointing the finger at the US and Israel, especially since it was concluded that the piece of malware was designed to target a specific version o...

TWSL2011-008: Focus Stealing Vulnerability in Android

Trustwave's SpiderLabs Security Advisory TWSL2011-008: Focus Stealing Vulnerability in Android https://www.trustwave.com/spiderlabs/advisories/TWSL2011-008.txt Published: 2011-08-06 Version: 1.0 Vendor: Google http://www.android.com/ Product: Android Versions affected: Tested on 2.1 - 2.3 Other...

Researchers Propose New Steganography System for Hiding Data

A group of researchers has developed a new application that can hide sensitive data on a hard drive without encrypting it or leaving any obvious signs that the data is present. The new steganography system relies on the old principle of hiding valuables in plain sight. Developed by a group of...

Hackers will not be deterred by UK cyber defences !

Military "cyber weaponry" will become commonplace this century, but it will be unlikely to deter attacks by "hacktivists" and criminal gangs, and could easily be used for state-sponsored cyber attacks instead, the Organisation for Economic Co-operation and Development warns. The British authors o...