Friday 24 October 2014

Ministry of Culture Exploited Fingers pointed at GForce


It is believed that the attack held on October 25th on India Culture website was held by GForce Pakistan, The data was released to pastebin. It was not released from none of the official accounts of G force on Pastebin. It was uploaded by Guest. Several codes and Documents of the site were leaked.
From 2001-2002 G Force was considered the Main team that was contributing in India-Pakistan Cyber war. The team continues to dominate the internet.

Paste

Hold Security shares data to NCSC which holds 1,3 million vulnerable Dutch e-mail addresses


The National Cyber Security Centre team (NCSC) and Hold Security have setup a cooperation which allowed the NCSC to get hold of 1,3 million vulnerable Dutch e-mail addresses and 5600 vulnerable Dutch websites.
Hold Security had announced that they had gained a massive dataset of 1.2 billion credentials via vulnerable websites worldwide.
The NCSC explains that the information which they have collected holds;
  • Usernames
  • Passwords
  • E-mail addresses which are used to login at the vulnerable websites
The National Cyber Security Centre has informed their partners, which will inform the identities which are identified in the dataset.
You can read the official Dutch press release here
https://www.ncsc.nl/actueel/nieuwsberichten/ncsc-verkrijgt-nederlandse-gegevens-van-hold-security.html

Related Posts to "Hold Security shares data to NCSC which holds 1,3 million vulnerable Dutch e-mail addresses"

Shellshock: A ‘Bash’ Bug which leaves almost every user on Internet vulnerable

This is a bug which is said to be very much bigger than the previous flaw called Heartbleed, which left all the secure SSL systems vulnerable, but this time a bug is found which able to compromise your system and then able to run commands or execute any malicious program onto your computer or device.

This harmful bug dubbed as ‘Shellshock’. As I said above this is a superbug, so here is, why it is called the SuperBug:
  • Shellshock is a Bash bug and able to exploit any operating system.
  • This Bug able to send a command to the exploited system through a code.
  • The particular area, which is able to exploit the system is generally blocked, but the Bash opens all doors to the system
  • Apple Mac OS X users able to run it from their terminal, others people linux operating systems also can.
    Apple Bash Bug
  • Windows is not affected in the same way, but if a hacker exploits malicious code through the flaw, they could gain access to any device, in theory, including PCs.
  • Working Example: As an Apache Web Sever runs bash command to process task along with the data entered in the online forms.
This flaw has been revealed by the hackers previously, and they are using this to exploit million of users online, UK Privacy regulator has already warned.
In simple words, The flaw is ‘Bash’ which contained in a piece of software and that software used by the operating systems and other website servers.
At this time, there is not any critical update or any idea found by the security researchers to save millions of users online, and the the UK and US governments also have issued national alerts in response to the bug, warning that it may compromise organisations responsible for “critical national infrastructure” such as power stations if it is not rapidly dealt with.
Statement issued by The Information Commissioner’s Office (ICO):
The Shellshock flaw “could be allowing criminals to access personal data held on computers or other devices”, which “should be ringing real alarm bells” for British businesses which are legally obliged to keep their customers’ details secure.
“The worst thing would be to think this issue sounds too complicated – businesses need to be aware of this flaw and need to be monitoring what they can do to address it. Ignoring the problem could leave them open to a serious data breach and ultimately, enforcement action.”

Who found this Flaw?

This critical flaw was found on 12 September by Stephane Chazelas, a 38-year-old French software developer living in Edinburgh. This Flaw uncovered “by chance”, he said to The Independent Today.
After finding this flaw, Chazelas reported this to Chet Ramey, a 49-year-old American programmer working at Case Western Reserve University in Ohio, and he maintains the Bash source code.
One more important thing about the Bug is, it is in the market from last 25 years and there is a question on this, Is it being used by the hackers from years ago?
Reports online inform that, this bug has been fixed by the Apple, but not informed anyone about this.
If you are a website owner and using Linux servers, so always go for a routine check for any updates for your operating system.
If there is any crack or update related to this comes out, we will update this post soon, but for now, you should secure yourself, by keep watching your security updates :)

Wednesday 15 October 2014

Crowd-Funding website Kickstarter Hacked, Customer Information Accessed by Hackers

According to Kickstarter’s blog post, on Wednesday night, law enforcement officials contacted Kickstarter and alerted them that hackers gained unauthorized access to some of it’s customers data. Kickstarter says that they took all the necessary security measures and they immediately closed the security breach.
No credit card data of any kind was accessed by hackers. There is no evidence of unauthorized activity of any kind on all but two Kickstarter user accounts.
While no credit card data was accessed, some information about their customers which included usernames, email addresses, mailing addresses, phone numbers, and encrypted passwords was stolen. In order to prevent upcoming hacks, the Kickstarter recommends it’s users to change their passwords as soon as possible with some strong passwords, so the hackers won’t be able to guess the real password, because them are encrypted. Right now, if the hackers who accessed the users data have enough computer power, they can crack the encrypted password.
As a precaution, we strongly recommend that you create a new password for your Kickstarter account, and other accounts where you use this password.
Some security measures taken by the Kickstarter Security staff:
  • Older passwords were uniquely salted and digested with SHA-1 multiple times. More recent passwords are hashed with bcrypt.
  • As a precaution they have reset all Facebook login credentials. Facebook users can simply reconnect when they come to Kickstarter.
  • Kickstarter does not store full credit card numbers. For pledges to projects outside of the US, we store the last four digits and expiration dates for credit cards. None of this data was in any way accessed.

How Hackers Changed The World – Anonymous – We Are Legion

How Hackers Changed the World – We Are Legion is a documentary about Anonymous, a hacking documentary released by BBC. It goes in depth to describe some cyber attacks such as Church of Scientology, Paypal, Amazon, Visa, Mastercard and world governments in order to shame them for their shady actions. Anonymous attacked online payment providers when they boycotted Wikileaks, they helped to provide black market Internet connections to disseminate information coming out of the Egyptian protest movement.
anonymous-emblem
According to Wikipedia, Anonymous is associated a loosely international network of activist and hacktivist entities. The group became known for a series of well-publicized publicity stunts and distributed denial-of-service (DDoS) attacks on government, religious, and corporate websites. You can find more details about the hackers group called Anonymous here.

CloudFlare Hit with 400Gbs NTP DDOS Attack

CloudFlare DDOS Attack, the largest Distributed Denial of Service Attack in the world! NTP based 400 Gbs DDOS Attack
Security company CloudFlare said Monday that a customer running on its platform was hit with a massive DDOS attack and that affected service in all the Europe, even in some of its US infrastructure.
“It was a very large DDoS targeting a CloudFlare customer,” Matthew Prince, CEO of Cloudflare told SecurityWeek. “We’re still gathering the log data to get exact numbers but know it was well over 300Gbps and likely over 400Gbps”, said Matthew Prince.
“The method was NTP reflection, which is quickly replacing DNS reflection as the source of the largest attacks”, said Matthew Prince.
CloudFlare did not mentioned the name of the customer that was targeted in this particular attack.The security firm is usually quite transparent about its operations.

What is DDOS Attack?
Distributed Denial of Service attacks were common in the last months. These affected sites like WordPress or Spamhaus and even led to the destabilization of the virtual currency Bitcoin. The Spamhaus DDoS attack was so great that it affected the speed of the Internet globally.
DDoS attacks are used to overwhelm servers with requests. All requests are directed to the same place on the server and thus there are no answers for new server requests. The Distributed Denial of Service ( DDOS ) is one of the best weapons of the hackers, because, until now, nearly every big site had been a victim of this attack.

What is ( Network Time Protocol ) NTP DDOS attack? How to understand it better.
ntp-ddos
The NTP method first began to appear late last year. To bring down a server such as one running “League of Legends,” the attackers trick NTP servers into thinking they’ve been queried by the “League of Legends” server.
The NTP servers, thinking they’re responding to a legitimate query, message the “League of Legends” server, overloading it with as many as 100 gigabits per second (Gbps). That’s large even for a DDoS attack.
In this way, one small request to an NTP server can generate an enormous response capable of taking down even high-capacity websites.

Ultra-fast battery that will end a nightmare: Loading in 2 minutes and can last 20 years

Researchers are close to finishing a new type of battery more efficient.
Batteries lead our life. They’re everywhere, from TV remote to phone or electric car batteries. Along with them came the nightmare of running out of battery when you need more.
A battery wich charge faster and hold more  seems unachievable dream smartphone users. Still, it could become reality. A team of researchers working on a new type of battery that could charge up to 70% of capacity in just two minutes. Moreover, the life of this battery is 20 times higher than current batteries. I mean,  even 20 years!
Ultra-fast battery developed by researchers in Singapore is so effective that an electric car could be loaded in just 15 minutes. Even if it sounds too good to be true, the team of physicists from the Nanyang Technological University wants to market it in less than two years, according to ScienceDaily.
The term is so short because no technology is new. Instead of reinventing the battery, the researchers optimized the existing technology, using a gel-based titanium oxide, the same substance found in sunscreens. Accelerates gel loading, and at the same time protects the interior materials from damage.
More than that, the batteries will be cheap because titanium dioxide is inexpensive and is found in soil. The team showed how they  formed the titanium dioxide for this new battery and requiered license for this technology.

Tuesday 14 October 2014

NSA and British intelligence services have hidden access to several German mobile network operators

American National Security Agency (NSA) and British intelligence have a hidden network access to several German operators, reports Der Spiegel, based on documents from Edward Snowden.
According to the German weekly, NSA program called “Treasure Map” has a clandestine access to Deutsche Telekom’s network and other smaller operators, which allows to reach Internet-connected devices – smartphones, computers and tablets. This program, named as a “Google Earth of the Internet” by Der Spiegel, serves to “planning of attacks” and “spy network” continues magazine, who could not obtain a response from the NSA and GCHQ , British service charge interceptions.
“Such cyber attack clearly violate German law,” commented Christian Steffen, general manager of Stellar operator, which Der Spiegel presented a document containing passwords belonging GCHQ company clients name a certain number of employees.
Alerted by the journal, Deutsche Telekom and regional operator Netcologne have not identified any suspect device and any data leakage. But according to the head of Deutsche Telekom Thomas Tschersich security, “foreign intelligence services access to our network is totally unacceptable.” “Examine any indication of a possible manipulation. Additionally, we alerted the authorities on this point,” said Tschersich quoted weekly.
Will be back with more details, soon !

UPDATE

What is the Treasure Map?
Treasure Map is the mandate for a massive raid on the digital world. It aims to map the Internet, and not just the large traffic channels, such as telecommunications cables. It also seeks to identify the devices across which our data flows, so-called routers.
In other words, every single end device that is connected to the Internet somewhere in the world: every smartphone, tablet and every computer is to be made visible. Such a map doesn’t just reveal one treasure. There are millions of them.
Treasure Map allows for the creation of an “interactive map of the global Internet” in “near real-time,” the document notes. Employees of the so-called “FiveEyes” intelligence agencies from Great Britain, Canada, Australia and New Zealand, which cooperate closely with the American agency NSA, can install and use the program on their own computers. One can imagine it as a kind of Google Earth for global data traffic, a bird’s eye view of the planet’s digital arteries.
You can read more details regarding the “Treasure Map” program here.

Bitcoin’s evolution on the map

Bitlegal is the easyest way to explore the evolution of the internet currency around the world.
You can search on this map for your country to see if the Bitcoin usage is Permissive / Contentious / Hostile / Unknown.
You should notice that:
BitLegal provides information about a developing area of the law and it is designed to help users make decisions about their own legal needs. Use of this site, or the information contained herein, does not create an attorney-client relationship. The content on this site is not offered as, does not constitute, and should not be relied upon it as a source of legal advice. Legal information is not the same as legal advice. Legal advice is the application of law to an individual’s specific circumstances. Nothing on this website should be considered a substitute for professional legal advice.
You can find more details on BitLegal’s official page.

Gmail hacked. Millions of Gmail accounts and passwords have appeared on the internet

Gmail was hacked today, about 5 million gmail accounts were published on Bitcoin Security Forum Russian hackers.
Alarming news this morning for those who have Gmail account. Russian hackers have published no less than 5 million users and passwords, but it seems we do not have serious reasons to panic.
Some Reddit users have discovered that there were not actually Gmail passwords, as originally written Russian media. These passwords should be occurring on sites throughout the years, sites that were associated with a Gmail address.
Google representatives confirmed that the list includes real accounts. However, company officials told TheNextWeb that “we have no evidence that our systems have been compromised.” It seems that only 60% of published accounts were active at the moment, and of the active accounts, many would have old passwords and not the actual password.
“ The security of our users information is a top priority for us ” said an employee of Google to  TNW. “We have no evidence that our systems have been compromised, but whenever we become aware that accounts may have been, we take steps to help those users secure their accounts.”
Most of users who appear on the list are Russians, but there are some users from Spain, USA and UK.
Therefore, the chances for you to be the victim are quite small write androidauthority.

UPDATE

Google says there is no security breach
It’s important to note that in this case and in others, the leaked usernames and passwords were not the result of a breach of Google systems”
We found that less than 2% of the username and password combinations might have worked, and our automated anti-hijacking systems would have blocked many of those login attempts. We’ve protected the affected accounts and have required those users to reset their passwords.

Windows 10 is the official name of the next operating system from Microsoft


Microsoft-windows10
The company introduced the operating system in a press event.
Windows 10 is the name of the future operating system from Microsoft, that should get on our computers at the end of next year. Therefore, the company will not name the next version of Windows 9 or Windows X or Windows One as everyone expected. New Windows 10 looks pretty good with Windows 7.
The Microsoft Windows 10 said it was “the most comprehensive platform ever built” so that version will be adapted to different hardwares. Good news for those who make applications for them, it should run smoothly in almost any conditions.

FBI: Companies from USA spends tens of billions annually against Chinese cyber espionage

Aggressive cyber war carried by China against the United States causing each year  losses worth billions of dollars to American companies, said FBI Director James Comey AFP reports.
According to federal police chief, the vast majority of American companies have been targeted by this type of activities. “There are two kinds of large companies in the United States. Those who know they have been hacked by the Chinese and those who do not know they have been pirated by the Chinese,” said Comey in “60 Minutes” of CBS.
Annual losses caused by cyber attacks launched from China are “impossible to figure”, but the number is in the order “billions,” according to FBI boss. Asked about countries that target the United States, Comey said, “I do not want to give you a complete list. But I can tell you that at the top of the list are Chinese.”
He quoted the example of the charges, in May, when five officers in the Chinese army stolen, during 2006-2014, trade secrets from American companies specialized in nuclear or solar energy and metallurgy.
Strong tension with Beijing
This case has caused severe tensions with Beijing. According to FBI Director hackers target this information to Chinese industry profits, which is exempted in this way to be “forced to invent”. But, he said, they are easy to spot. “I’m going to think of drunken thieves. Break the door, slam the vase and leave the TV under his arm,” he said. “I am simply fruitful. It might say their strategy is” we are everywhere, always. and they never manage to arrest us again ‘”, said the head of the FBI.
In 2013, the California-based cybersecurity firm Mandiant said Chinese had launched cyber-attacks on 141 organisations across 20 industries. Targets included government departments, private companies, from the Pentagon to the New York Times. NGOs were also targeted. Mandiant linked a number of attacks to a military-affiliated group based in nondescript building on the outskirts of Shanghai.

Google warns: Espionage of the USA risks “breaking the internet”

Cyber espionage practiced by the United States is a threat that could lead to “breaking the internet” warns Supervisory Board Chairman of Google, Eric Schmidt.
“The impact is serious and is getting worse,” said he. “The result of the simplest scenario is that we get to break the Internet,” he warned. Schmidt made ​​the statement during a debate on the consequences of spying on Internet technology sector intrerpinse by American intelligence services (NSA), an event organized by the chair of the Senate Finance Ron Wyden. Participants revealed the emergence of disguised trade barriers, some countries calling for the groups now active in the field of Internet and data services to host their servers rather local and not in the United States.
“The idea of ​​having to install data centers and regional data-themselves fundamentally opposes the way the Internet is structured,” said Colin Stretch, Legal affairs on Facebook. His counterpart from online storage service Dropbox Ramsey Homsany revealed, in turn, the difficulties this can create startups that are based on Silicon Valley fame. “Imagine what would have happened if (Google founders) Larry (Page) and Sergey (Brin), in their garage, they had the second thing on the list to build a data center in Germany,” commented himself.
Participants in the debate have prompted American lawmakers to clean up online intelligence practices in order to regain the trust of the international community. Until then, they find it necessary to attack them, the problem themselves, enhancing security and protection services and their networks.
“In the absence of better laws, we are forced to invest in better technologies,” noted Brad Smith, Microsoft’s Legal affairs. “If people are worried about government encryption, it is necessary to invest in better laws,” he urged. American giants in technology have complained numerous times of Internet surveillance by the United States, revealed by former NSA consultant Edward Snowden. Mark Zuckerberg, founder of Facebook, called directly on President Obama in March, to complain about the “threat” represented by this oversight. John Chambers, CEO of Cisco, telecom equipment manufacturers, wrote for the president, complaining that the practice harms the intelligence agencies’ ability of technology companies to deliver products on a global scale. “

Friday 10 October 2014

Google works Like NSA by collecting, storing, and indexing user data: Assange

ulian Assange, the WikiLeaks founder, has confirmed that Google collects, stores, and indexes people’s data, and is in fact ‘a privatized version of the NSA,’ according to media reports.
“Google’s business model is the spy. It makes more than 80 percent of its money by collecting information about people, pooling it together, storing it, indexing it, building profiles of people to predict their interests and behavior, and then selling those profiles principally to advertisers, but also others,” Assange told BBC.
However, he also admitted that it is not doing anything that is illegal.
The founder argued that Google’s work practices are almost identical to NSA adding that the company has been working with the NSA since at least 2002, in terms of contract.
“They are formally listed as part of the defense industrial base since 2009. They have been engaged with the Prism system, where nearly all information collected by Google is available to the NSA,” he said.
Additionally, at the institutional level, “Google is deeply involved in US foreign policy.”
Assange told BBC that Google has become the most influential commercial organization with its ramifications across every country and every single person with access to Internet.
He further said that the company has tricked people into believing that it is a humane organization and not a big, bad US corporation.
Julian Assange, 43 year old Australian, is staying at the Ecuadorian embassy in London since 2012. The embassy is being watched by British police round the clock who are ready to arrest him should he attempt to leave.
His stay at the embassy has impacted his work, said Assange.
“The 7.3 million pounds (US$12 million) of police surveillance admitted outside this embassy. It is a difficult situation. It is not a situation that is easy for [a] national security reporter. You can’t read sources. It is difficult to meet some of my staff because of that surveillance.”
However, he pointed the brighter side of his restricted movements as well.
“There are no subpoenas, there are no door knocks in the night, unlike [for] other national security reporters. So in some ways there are benefits to the situation,” he noted.
He has been optimistic about the attitude shift that has taken place recently. Britain amended its extradition laws to ban extradition without charges.

Help The Poor, Help The Homeless: Anonymous Relaunches OpSafeWinter

Anonymous, the famous hacktivists collective, is back again with its most effective non-hacking operation, OpSafeWinter.
The outreach operation, which started on 7 November 2013, to provide homeless people with basic necessities like food, warm clothing and camping supplies is back again this year as well.
A press release posted on the Pastebin read,
“Fellow Anon and Citizens of the world, We are proud to re-announce #OPSafeWinter. In this age of consumerism there is very little love or care about each other, and we’re here to change that. No longer shall we stand by and watch isolation and fear be spread by the establishment, which is killing and destroying community and lives. We all have a voice, so make yours heard, you are the power, your choice, your life, you are the motivation for justice.”
Our mission: to highlight the homeless situation in areas throughout world. Build up a resource network for food supply, blankets, clothes socks etc. that can be donated. Amenities for warm showers etc.
1st Mission:
Please list the current homeless count in alphabetical order by town/City Country. Within each town contact local charities, shops, businesses that will support with any of the above list and more. You can get the latest figures from your local council by sending them a freedom of information request if you are not sure of the figures in your town.
anonymous-relaunches-opsafewinter
2nd Mission:
Coordinate with anons and others willing to participate in the execution/distribution of services we are able to provide. Whether its’ transport, collection of donations etc.
This is not definitive, any other suggestions ideas are welcome. Please list at the bottom of the pad as bullet points to make it easy to follow.
Lets make winter as safe and comfortable for as many people within our reach and beyond.
@OpSafeWinter #OpSafeWinter
https://www.facebook.com/anonymousopsafewinter
The Cryptosphere, who interviewed the international team behind it, of course under the anonymous shield, reported that the new session starts with a stronger team, better focus, knowledge to dealing with law enforcement implications and a year’s experience.
The team said that despite its name, the operation will continue across the year because it is a global initiative.
“Homelessness is growing on Earth, by leaps and bounds, so continuing the Op throughout the year was an effective way to combat homelessness.”
The idea, which had its origin on the irc in a chat, was well received by many round the globe and within two weeks it had gone global, said one of the team member.
Surprising was the negative response from charities that they thought would actually applaud them for the inventiveness, the team said adding that they would ensure plenty of disclaimers highlighting no monetary donations.
“Any campaign asking for monetary donations will be seriously vetted before a hint of endorsement is shown.”
When asked about media coverage, the team replied that though they did not have mainstream media coverage, they did receive amazing radio coverage and limelight through Elite daily and some UK-based homeless publications.
With hardly any changes in any of its objectives since it was launched last year, the operation still echoes the same mission as it had last year.
“Success would be people recognizing that homeless people are just that…PEOPLE. They deserve compassion and care, just like anyone else. Some actual full-blown shelters have been set up as a result of the Op, [whereas] some see success as a Feed The Homeless Day or a blanket give away,” said the Anonymous team member.
The operation was endorsed by people from 12 countries around the globe [officially and many on ad-hoc basis] last year with the UK, the US and Brazil as being the most active countries. The operation not only sought to help homeless people but also raise awareness about homelessness.

Indian hacker defaces Pakistans’ major political Party ”PPP” website amid Kashmir issue

An Indian hacker going with the handle of Bl@Ck Dr@GoN has hacked and defaced the official website of Pakistan People’s Party, which is country’s oldest political party.
The hack was done against a tweet made by chairman of PPP Bilawal Zardari in which he had vowed to take back the Indian controlled Jammu and Kashmir.
Indian hacker along with his friends left a deface page with a message against the tweet expressed in following words:
‘Hello Mr. Bilawal Bhutto !!! To Citizens of Pakistan, Pakistan’s Army, Pakistan Peoples Party and Specially Mr. Bilawal Bhutto . Without any Violence Let Me tell you that Pakistan will never Get Kashmir. This is the Truth. You Have to Accept it :) So Mr. Bhutto You Want Kashmir ???? Huh xD “Laavange Laavange, Kashmir, Poora Kashmir !!!” Bitch Please.’
A preview of deface page is available below:
Deface page left by the hacker
Deface page left by the hacker
Tweet from PPP’s chairman:
Link of targeted website along with a mirror as a proof of hack is available below:
According to the website of Pakistani mission in the UN:
‘The Kashmir dispute is the oldest unresolved international conflict in the world today. Pakistan considers Kashmir as its core political dispute with India. So does the international community, except India.’
This is not the first time when People’s party website has been hacked. In past, Pakistani group had hacked the site; following with Nigerian Cyber Army hacking the site for second time in 2013.
At the time of publishing this article, the PPP’s website was down.