Twitter Implements Perfect Forward Secrecy

Twitter took another step toward not only securing the privacy of its users’ communication over the social network, but in warding off the prying eyes of government surveillance with the implementation of Perfect Forward Secrecy. The technology thwarts the efforts of anyone who may be collecting...

Passive Security Community Turned Activist

Security people like to call themselves a community, but until June some might say its greatest community achievement is turning Twitter into its own private and contentious echo chamber. But since the Snowden leaks, there’s been a palpable change and a marked swell in stand-taking. Tweeters have...

Twitter Fixes Bug that Enabled Takeover of Any Account

Security researcher Henry Hoggard recently discovered a cross site request forgery CSRF vulnerability in Twitter’s “add a mobile device” feature, giving him the ability to read direct messages and tweet from any account. Hoggard, a security researcher at MWRInfosecurity, told Threatpost via email...

Twitter Underground for Phony Follower Accounts Thriving

Buying Twitter followers is standard practice for celebrities, politicians, startups, and even so-called social media experts who want to boost their online Q Score. So it shouldn’t be surprising that hackers have noticed this market opportunity and are building a formidable underground business...

Enigmatis CMS Cross Site Scripting / SQL Injection

Exploit Title: Enigmatis CMS XSS/SQLInjection Vulnerability Date: 2013 4 November Author: Hossein Hezami Dr.3v1l Vendor: http://www.enigmatis.pl Version: All Version Security Risk: High Category: WebApps Google Keywords: intext:"Created by Enigmatis" inurl:"pl/?pid=" Tested on: Linux Exploit :...

WordPress ThisWay Shell Upload

. . / / | // | | .. / \ \ \ \ \ / ||| \ | | / \ / |/ | |/ | / | | // | | | | \ / //|| /\ \ ||| / | /\ /// \ \ //|| | / /|| /| ||/|| / / / / || // / / / / || / / Exploit title: WordPress ThisWay theme - Arbitrary File Upload Vulnerability Author: Bet0 Google Dork:...

Tweetbot Lack Of User Confirmation

Affected Vendor: http://tapbots.com/ - Affected Software: Tweetbot for Mac, iPad and iPhone - Affected Version: Mac: 1.3.3 - iPad: 2.8.5 - iPhone: 2.8.5 - Issue Type: Lack of user confirmation leading to Twitter action revealing the user's Twitter identity - Release Date: November 1, 2013 -...

Critical vulnerability in Twitter allows attacker to upload Unrestricted Files

Security expert Ebrahim Hegazy, Cyber Security Analyst Consultant at Q-CERT, has found a serious vulnerability in Twitter that allows an attacker to upload files of any extension including PHP. When an application does not validate or improperly validates file types before uploading files to the...

Critical vulnerability in Twitter allows attacker to upload Unrestricted Files

Security expert Ebrahim Hegazy, Cyber Security Analyst Consultant at Q-CERT, has found a serious vulnerability in Twitter that allows an attacker to upload files of any extension including PHP. When an application does not validate or improperly validates file types before uploading files to the...

Barack Obama's Twitter, Facebook, Campaign website and Email Accounts hacked by Syrian Electronic Army

The pro-Assad group Syrian Electronic Army claims it has hacked the President Barack Obama's website , Twitter-Facebook accounts and access email accounts linked to Organizing For Action, the non-profit offshoot of Obama For America, Obama's 2012 campaign operation. Last night, Syrian Electronic...

Dutch Police arrested TorRAT Malware Gang for stealing over Million Dollar

The TorRAT malware was first appeared in 2012 as spying tool only. But from August 2012, Bitcoin Mining feature was added and it became a powerful hacking tool that was commonly associated with attacks on Financial institutions. ab This year TorRat Malware targeted two out of three major Banks in...

Buffer hacked; Twitter, Facebook flooded with Spam Weight-loss links

If you're a user of the Buffer app, the social-media management service that let you cross-posting to various social networks, be aware that the service got hacked yesterday, with spam messages going out over Facebook. "Buffer was hacked around 1 hour ago, and many of you may have experienced spa...

Buffer hacked; Twitter, Facebook flooded with Spam Weight-loss links

If you're a user of the Buffer app, the social-media management service that let you cross-posting to various social networks, be aware that the service got hacked yesterday, with spam messages going out over Facebook. "Buffer was hacked around 1 hour ago, and many of you may have experienced spa...

Hacker stole $100,000 from Users of California based ISP using SQL Injection

In 2013 we have seen a dramatic increase in the number of hack attacks attempted against banks, credit unions and utility companies using various techniques including DDoS attack, SQL injection, DNS Hijacking and Zero-Day Flaws. SQL Injection is one of the most common security vulnerabilities on...

US news agency GlobalPost's twitter and website hacked by Syrian Electronic Army

In a series of high profile hacks, 'Syrian Electronic Army SEA' just a few minutes before took control twitter account and website of 'GlobalPost', a US based news agency. 'Syrian Electronic Army is an organized hacking group loyal to the Syrian President Bashar al-Assad and known for their high...

US news agency GlobalPost's twitter and website hacked by Syrian Electronic Army

In a series of high profile hacks, 'Syrian Electronic Army SEA' just a few minutes before took control twitter account and website of 'GlobalPost', a US based news agency. 'Syrian Electronic Army is an organized hacking group loyal to the Syrian President Bashar al-Assad and known for their high...

CVE-2013-5157

The Twitter subsystem in Apple iOS before 7 does not require API conformity for access to Twitter daemon interfaces, which allows attackers to post Tweets via a crafted app that sends direct requests to the daemon...

CVE-2013-5158

The Social subsystem in Apple iOS before 7 does not properly restrict access to the cache of Twitter icons, which allows physically proximate attackers to obtain sensitive information about recent Twitter interaction via unspecified vectors...

Code injection

The Twitter subsystem in Apple iOS before 7 does not require API conformity for access to Twitter daemon interfaces, which allows attackers to post Tweets via a crafted app that sends direct requests to the daemon...

Information disclosure

The Social subsystem in Apple iOS before 7 does not properly restrict access to the cache of Twitter icons, which allows physically proximate attackers to obtain sensitive information about recent Twitter interaction via unspecified vectors...