Ed Felten Joins White house as Deputy CTO

Ed Felten, a professor at Princeton University and a well-respected voice on security and privacy issues, is joining the White House as the deputy CTO. In his new role, Felten will be working under Megan Smith, the CTO of the United States and a former Google vice president. Felten has been at...

Digital Campus System Arbitrary File Upload Vulnerability at Shanghai Dingchuang Information Technology Co.

Ltd. is based on China's education informatization business, is committed to the development of research and development of convenient and easy to use campus management software. The vulnerability in the upload of arbitrary files in the Digital Campus System of Shanghai Dingtron Information...

Cybrary Offers Free Online Ethical Hacking and Cyber Security Training

I frequently receive emails and messages on how to hack my friend’s Facebook account, how to become a hacker, how to penetrate networks, how to break into computers, and how to compromise routers? These are some of the most frequent queries I came across, and in this article I’ll attempt to answe...

Section 66A of IT Act is Unconstitutional, Supreme Court Rules

The Supreme Court of India today struck down Section 66A of the Information Technology Act -- a controversial law that allowed law enforcement officials to arrest people for posting "offensive" comments on social networks and other internet sites. After hearing a clutch of petitions by defenders...

某政府信息公开系统存在SQL注入

简要描述： RT 详细说明： 吉大正元信息技术股份有限公司:http://www.jit.com.cn/ 众多政府网站都在使用该系统 我就用5个案例来测试。 注入链接是： /zwdtSjgl/infoIndex.jsp?channelCid= 案例： http://218.27.207.22/zwdtSjgl/infoIndex.jsp?channelCid=6 http://218.27.190.107:8080/zwdtSjgl/infoIndex.jsp?channelCid=9...

Godzilla Hacker Takes Down Several Pakistani Government Websites

While the rest of the world was engaged in cyber security and privacy, an Indian patriotic hacker targeted 43 major Pakistani Government official websites, including ‘President of Pakistan’, ‘Government of Pakistan’, 'Ministry of Defence’, and whole Ministry of Pakistan. Indian hacker Godzilla...

Canada NRC Hit by Apparent Chinese Cyber Attack

One of Canada’s premier research and technology organizations was hit with a cyber-attack recently that forced the cooperative offline; the attack – which appears to be Chinese in origin – was so serious the organization is being forced to rebuild its entire system. The National Research Council ...

Regulators To US Banks: Be Vigilant of ATM Fraud, DDoS

U.S. regulators are warning banks this week about a recent rash of “large dollar value” ATM fraud and the ongoing risks distributed denial of service DDoS attacks that target public bank websites can pose. Members of FFIEC, the Federal Financial Institutions Examination Council, an interagency se...

DoD DIACAP transition to RMF approved

Welcome DIARMF! This has been a long time coming. From DITSCAP to DIACAP and now to DIARMF the Department of Defense approved the transition to a Risk Management Framework RMF approach developed by NIST on March 12. What does this mean for Information Systems and Platform Information Technology...

CBI arrests Indian mastermind behind Hire-a-Hacker service on FBI tip-off

For the first time in history, Indian Law Enforcement Agency 'Central Bureau of Investigation' CBI has arrested a Cyber criminal after getting a tip-off from the US Federal Bureau of Investigation FBI. 33-Year-old Amit Vikram Tiwari, son of an Indian Army colonel and an engineering dropout, who...

Department of Energy Susceptible to Attack

An audit of the Department of Energy has shown that 29 new weaknesses emerged on the agency’s networks this year in addition to 10 existing that the DoE failed to fix after a 2012 audit. The audit, undertaken by the Office of Inspector General and the Office of Audits and Inspections, revealed...

New Injection Campaign Peddling Rogue Software Downloads

A mass injection campaign has surfaced over the last two weeks that’s already compromised at least 40,000 web pages worldwide and is tricking victims into downloading rogue, unwanted software to their computer. The campaign, dubbed GWload by researchers at Websense, relies on a Cost Per Action sc...

Linkedin Social Network - Persistent Web Vulnerability

Document Title: =============== Linkedin Social Network - Persistent Web Vulnerability References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=962 Linkedin Security Ticket ID: 130429-005211 Release Date: ============= 2013-06-07 Vulnerability Laboratory ID VL-ID...

MOXA Weak Entropy in DSA Keys Vulnerability

Overview Researcher Nadia Heninger of the University of California, San Diego, and researchers Zakir Durumeric, Eric Wustrow, and J. Alex Halderman of the University of Michigan identified an insufficient entropy vulnerability in MOXA OnCell Gateways. MOA produced and released a firmware upgrade ...

亿中邮（亿邮）信息技术官方网站沦陷,已成功进入后台

简要描述： 今天本身没事。为了不让他买叫我盲打王。 所以就打算随便找一个厂商 进行一次 脚本入侵。然后就找到了“亿中邮信息技术” 我大概说一下。没拿下webshell 后台设置了禁止写入。包括数据库备份 根本不可能。另外上传页面直接删除掉了。 但是你们网站的问题很大。 整个入侵过程一共是 20分钟。你们后台就沦陷了！·下面我大概讲一下入侵的整个思路 详细说明： 首先是网站主站有个意见反馈。然后我就很随意的 插入代码了。但是。返回的提交成功 一看就知道 dedecms页面。 然后我就知道。肯定是 失败的。 然后打开data/admin/ver.txt 发现版本很老啊。...

Canonical to create UbuntuKylin OS for Chinese users

Canonical, the software company that manages and funds Ubuntu, announced to develop a new, open-source operating system customized especially for Chinese users called 'UbuntuKylin OS'. According to the BBC, Chinese government and Canonical partner to launch its home grown operating system. China...

Child Porn on Indian Government websites

One of the 'The Hacker News' reader inform us today about porn content on some Indian Government websites. After analyzing such websites, we came across more than 30 sub domains belongs to 'entegramam.gov.in' . Where 'entegramam' means "My village" and all sub domains of this website are names of...

F5 BIG-IP - Authentication Bypass

!/usr/bin/python Title: F5 BIG-IP Remote Root Authentication Bypass Vulnerability py Quick script written by Dave Kennedy ReL1K for F5 authentication root bypass http://www.secmaniac.com import subprocess,os filewrite = file"priv.key", "w" filewrite.write"""-----BEGIN RSA PRIVATE KEY-----...

Plogger Photo Gallery SQL Injection

Exploit Title: Plogger Photo Gallery Script SQL Injection Vulnerability Date: 2012 Author: Eyup CELIK Version: All Version Tested on: All versions are Vulnerability Web Site: www.eyupcelik.com.tr Issue: SQL Injection Risk level: High The remote attacker has the possibility to execute arbitrary SQ...

What We Learned at HIMSS12

A few weeks ago, more than 35,000 healthcare IT professionals and 1,100 exhibitors converged on Las Vegas. Some were there to go shopping for "HIT" or health information technology; others were there to sell it. The IT professionals from across the healthcare spectrum were there to meet with each...