All Hands Memo to Owners of Home / Small Office Routers: Reboot Them!

This last week or so of May has been busy with security news and incidents, as the FBI put out an unprecedented call to do a massive wave of reboots of home and small office routers, while Intel confirmed the existence of yet another Spectre / Meltdown variant. And, yes, we had yet another...

Facebook Graph OpenSearch Phone Number Metadata Crosswalk Mapping

!/usr/bin/perl Facebook 'Graph' OpenSearch Phone Number metadata crosswalk mapping PoC 2018 Todor Donev https://ethical-hacker.org/ https://facebook.com/ethicalhackerorg Description: Criminal hacker CRACKER can take advantage of this weakness by creating a specialized database to manipulate...

10 years prison for man who hacked 200 firms & sold data on Dark Web

By Waqas The hacker also sold drugs on Dark Web and taught This is a post from HackRead.com Read the original post: 10 years prison for man who hacked 200 firms & sold data on Dark Web...

Mail.ru: Clickjacking Vulnerability on https://support.my.com/games/ticket/xxxx/

Hi There, I have found a Clickjacking vulnerability on your site. Steps to reproduce: 1.Go to https://support.my.com this site 2.Generate a Clickjacking script, save it as .html and run into your browser Script: iframe width: 800px; height: 500px; position: absolute; top: 0; left: 0; filter:...

WiFi hacker: 10 best Android & Desktop WiFi hacking apps free download

By Waqas Hacking is no more the specialty of experts and professionals This is a post from HackRead.com Read the original post: WiFi hacker: 10 best Android & Desktop WiFi hacking apps free download...

Valve: Unfiltered input allows for XSS in "Playtime Item Grants" fields

Enter "test in any of the 3 fields, save it and reload the page. Impact Stored XSS, could possibly break some internal features too as the stored value is not an integer. The hacker selected the Cross-site Scripting XSS - Stored weakness. This vulnerability type requires contextual information fr...

Hacker access critical code of British cell operator EE

By Waqas EE, a British mobile network giant owned by BT Group has This is a post from HackRead.com Read the original post: Hacker access critical code of British cell operator EE...

Man who hacked West Point military academy website arrested from LA

By Waqas A hacker who hacked and defaced more than 11,000 websites This is a post from HackRead.com Read the original post: Man who hacked West Point military academy website arrested from LA...

The AI’ker’s Guide to the (cybersecurity) Galaxy

As a security veteran I find myself from time to time having to explain to newbies the importance of adopting a ‘hacker’s way of thinking’, and the difference between hacker’s and builder’s thinking. If you can’t think like an attacker, how are you going to build solutions to defend against them?...

LC4: Another Pen-and-Paper Cipher

Interesting symmetric cipher: LC4: Abstract: ElsieFour LC4 is a low-tech cipher that can be computed by hand; but unlike many historical ciphers, LC4 is designed to be hard to break. LC4 is intended for encrypted communication between humans only, and therefore it encrypts and decrypts plaintexts...

Man Who Hacked Jail Systems to Release His Friend Early Gets 7-Years in Prison

Remember a young hacker who hacked jail systems in an attempt to release his prison inmate early? Well, that hacker will now be joining his inmate behind bars. Konrads Voits of Ypsilanti, Michigan, has been sentenced to seven years and three months in prison for attempting to hack the Washtenaw...

Uber Tightens Bug Bounty Extortion Policies

Uber is tightening policies around its bug-bounty program after a 2016 data breach exposed deep flaws in its policies around handling extortion. The ride-sharing company has updated its program to include clarity around the boundaries between research versus blackmail. The changes come after a 20...

Amazon Alexa Has Got Some Serious Skills—Spying On Users!

"Alexa, are you spying on me?" — aaaa.....mmmm.....hmmm.....maybe!!! Security researchers have developed a new malicious 'skill' for Amazon's popular voice assistant Alexa that can turn your Amazon Echo into a full-fledged spying device. Amazon Echo is an always-listening voice-activated smart ho...

Use of ‘StegWare’ Increases in Stealth Malware Attacks

SAN FRANCISCO – Researchers are warning of an uptick in the malicious use of steganography as a vehicle for delivering malware. Steganography, they say, is increasingly becoming a go-to tool for cybercriminals not just for infection, but also command-and-control, data exfiltration and as an...

Woman who hacked airline network busted through VPN logs

By Waqas VPN Logs Lead to Capturing of an Ex-PenAir Employee Who This is a post from HackRead.com Read the original post: Woman who hacked airline network busted through VPN logs...

Automated Bots Growing Tool For Hackers

SAN FRANCISCO – The use of automated bots is becoming more prevalent for novice attackers as tools become more available, researchers found. A honeypot experiment, detailed by Cybereason at this year’s RSA Conference, showed the commoditization of using bots to perform low-level tasks. The honeyp...

Facebook Graph Phone Number Metadata Crosswalk Mapping Proof Of Concept

!/usr/bin/perl Facebook 'Graph' Phone Number metadata crosswalk mapping PoC 2018 Todor Donev https://ethical-hacker.org/ https://facebook.com/ethicalhackerorg Description: Criminal hacker CRACKER can take advantage of this weakness by creating a specialized database to manipulate facebook users...

Facebook Graph Metadata Crosswalk Mapping Proof Of Concept

!/usr/bin/perl Facebook 'Graph' metadata crosswalk mapping PoC 2018 Todor Donev https://ethical-hacker.org/ https://facebook.com/ethicalhackerorg Description: Criminal hacker CRACKER can take advantage of this weakness by creating a specialized database to manipulate facebook users with fake news...

360 security browser to fix more Chrome kernel vulnerabilities and plugging the hacking of door-vulnerability warning-the black bar safety net

Recently, a new version of 360 browser first to fix the Google Chrome kernel exposed a number of security vulnerabilities, of which more than half of the vulnerabilities are high-risk vulnerability that could be used for arbitrary code execution or DoS attacks. Since the 360 browser uses IE and...

Zomato: Clickjacking: Delete Account, Change privacy settings, Rate business, follow/unfollow (IE)

Inspired by report 337219. Please note that this report includes a clear security impact as well as a proof of concept. CVSS ---- medium 5.0 CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:L Description ----------- The application does not send a X-Frame-Options header, thus allowing pages to be...