Showing posts sorted by date for query Paypal. Sort by relevance Show all posts
Showing posts sorted by date for query Paypal. Sort by relevance Show all posts

British Spy Agency GCHQ Performed DDoS Attack Against Anonymous -Snowden Documents Transpired

British Spy Agency GCHQ Performed DDoS Attack Against Hacktivist Anonymous & LulzSec -Snowden Documents Transpired
While excavating the past, it was always found that cyber criminals, large hacker collective groups were the culprits for engaging voluminous denial of service attack. But this widely transfusing story get a one eighty degree reverse turn, when the former NSA contractor Edward Snowden revealed another trade secret. Recently a lurid story get spot lighted, as the whistle blower Snowden unfold yet another breathtaking stealthy  documents taken from the National Security Agency. The clandestine documents taken the mask from the so called good guys, unveiling British spy agency GCHQ had launched a secret war against the infamous hacktivist collective Anonymous and a splinter group known as LulzSec several years ago. Many of you guessed right, this was happened when Anonymous were targeting various UK companies and government websites. The documents disclose that GCHQ carried out seemingly illegal DDoS attacks against the collective, flooding their chatrooms with so much traffic that they would become inaccessible – and all with the approval of the British government. The revelations come less than a year after several LulzSec activists were jailed by a British court for carrying out similar DDoS attacks against targets including the CIA, the UK’s Serious Organized Crime Agency (SOCA), News International, Sony and the Westboro Baptist Church, among others. 
This sensational issue was made public by NBC News deferentially with the help of none other than Edward Snowden. In their exclusive report headed 'War on Anonymous: British Spies Attacked Hackers,' NBC said -The blunt instrument the spy unit used to target hackers, however, also interrupted the web communications of political dissidents who did not engage in any illegal hacking. It may also have shut down websites with no connection to Anonymous. According to the documents, a division of Government Communications Headquarters (GCHQ), the British counterpart of the NSA, shut down communications among Anonymous hacktivists by launching a “denial of service” (DDOS) attack – the same technique hackers use to take down bank, retail and government websites – making the British government the first Western government known to have conducted such an attack.
The documents, from a PowerPoint presentation prepared for a 2012 NSA conference called SIGDEV, show that the unit known as the Joint Threat Research Intelligence Group, or JTRIG, boasted of using the DDOS attack – which it dubbed Rolling Thunder -- and other techniques to scare away 80 percent of the users of Anonymous internet chat rooms. 
The existence of JTRIG has never been previously disclosed publicly. The documents also show that JTRIG infiltrated chat rooms known as IRCs and identified individual hackers who had taken confidential information from websites. In one case JTRIG helped send a hacktivist to prison for stealing data from PayPal, and in another it helped identify hacktivists who attacked government websites. 
As soon as this story getting all the spot lights, immediately the GCHQ responded to this saying all their movements and operations were lawful“All of GCHQ’s work is carried out in accordance with a strict legal and policy framework which ensure[s] that our activities are authorized, necessary and proportionate, and that there is rigorous oversight, including from the Secretary of State, the Interception and Intelligence Services Commissioners and the Parliamentary Intelligence and Security Committee. All of our operational processes rigorously support this position.” -GCHQ said the press. To know more detail about this story, don't forget to stay tuned with VOGH



SHARE OUR NEWS DIRECTLY ON SOCIAL NETWORKS:-

'PayPal 14' Culprits Enter Guilty Pleading Over Pro-WikiLeaks DDoS Attack Versus PayPal

Accused 'PayPal 14' Culprits of Anonymous Enter Guilty Pleading Over Pro-WikiLeaks DDoS Attack Versus PayPal

I am quite sure that all of your regular readers still remember the devastating cyber attack from Anonymous against PayPal, the attack was conducted under the banner of Operation PayPal (#OpPayPal). The infamous hacker community stated a reason for this mass protest as the online payment company suspending the account of WikiLeaks. #OpPayPal is considered as one of the most demolishing cyber attack ever taken in cyber space. PayPal with law enforcement agencies immediately taken steps and start investigation, in the primary step PayPal sent 1000 IP address of Anonymous hacker who was linked on that attack to FBI. As expected the hackers who were behind that attack was serially busted by the police. And finally the accused anonymous hacker appeared in federal court in California on Thursday and will be formally sentenced in one year. Eleven of the so-called “PayPal 14” members each pleaded guilty in court to one felony count of conspiracy and one misdemeanor count of damaging a computer as a result of their involvement in a distributed denial-of-service (DDoS) attack waged by Anonymous in late 2010 shortly after PayPal stopped processing donations to the anti-secrecy group WikiLeaks. Prosecutors say the defendants used a free computer program called the Low Ion Orbit Cannon, aka LOIC, to collectively flood PayPal’s servers with tremendous amounts of illegitimate internet traffic for one week that winter, at moments knocking the website offline as a result and causing what PayPal estimated to be roughly £3.5 million in damages
Pending good behavior, those 11 alleged Anons will be back in court early next December for sentencing, atpleading guilty to the misdemeanor counts only, likely removing themselves from any lingering felony convictions but earning an eventual 90 day jail stint when they are finally sentenced. A fourth defendant, Dennis Owen Collins, did not attend the hearing due to complications involving a similar case currently being considered by a federal judge in Alexandria Virginia in which he and one dozen others are accused of conspiring to cripple other websites as an act of protest during roughly the same time.
which point the felony charges are expected to be adjourned. Two of the remaining defendants cut deals that found them. In his press reaction defense attorney Stanley Cohen said the terms of the settlement were reached following over a year of negotiations, “based upon strength, not weakness; based upon principle, not acquiescence.” In the courtroom all the accused hacker stood up and said, ‘We did what you said we did . . .We believe it was an appropriate act from us and we’re willing to pay the price.’ 
On the other hand Cohen, who represented PayPal 14 defendant Mercedes Haefer in court, said one of the hacktivists told him after Thursdays hearing concluded that "This misdemeanor is a badge of honor and courage." When media questioned Michael Whelan, a lawyer for one of the defendants, he declined to comment on the plea. 


-Source (RT)

SHARE OUR NEWS DIRECTLY ON SOCIAL NETWORKS:-

Master Card Blog Hacked & defaced By Syrian Electronic Army

Master Card Payments Perspectives Blog Hacked & defaced By Syrian Electronic Army

It's became a very common scenario that hackers targets banks, payment gateway and other financial sectors. Sites like Paypal, Visa, Master Card were among those common victims who used to face massive round of cyber attacks. Past two years hacktivist managed to interrupt the service of those websites many times. Here also in the beginning of 2013 almost same situation took place, when the official blog of Master Card get hacked and defaced.  It was the Saturday evening when a hackers collective group named "Syrian Electronic Army" managed to breach and get access inside Master Card blog. I am sure that all our readers will be shocked after hearing the way of intrusion. In the platform of the blog, Master Card was using an older version of WordPress (Ver. 3.3.2) which has several critical vulnerabilities like XSS, file uploading, CSRF and so on. Exploiting those loopholes the hacker managed to get access inside the blog and defaced one of the page of the giant in international financial services company's blog. Though WordPress have released a security patch and also version 3.5, but it's quite unfortunate and shocking that Master Card did not even patched their older version for which their system get penetrated. It is truly unbelievable that sites like Master Card is so careless about basic security and counter measure of cyber attack. According to sources Syrian Electronic Army used  the CSRF exploit of WordPress which is said to be available on the Internet and allows an attacker to add a new administration user. This is a possible explanation of how the Syrian Electronic Army managed to hack and deface the blog. After this incident occurs Master Card immediately updated the version of WP and closed those back doors. Still the the defaced and cached version of the  blog can be viewed on Google’s Web Cache







SHARE OUR NEWS DIRECTLY ON SOCIAL NETWORKS:-

British Court Convicts Anonymous Hacker "Nerdo" For DDoS Attack Over WikiLeaks Funding

British Court Convicts Anonymous Hacker "Nerdo" For DDoS Attack Over WikiLeaks Funding

Another alleged Anonymous hacker faced cour rule. A British court has convicted a 22-year-old for allegedly being a ‘key figure’ behind Anonymous DDoS attack on PayPal in revenge for its freezing WikiLeaks payments. A 22-year-old British student Christopher Weatherhead, self described "hacktivist", going by the name of "Nerdo" was convicted by the jury on a count of conspiracy to impair computer operations. The conviction came after guilty pleas of three of Weatherhead's co-conspirators.
"Christopher Weatherhead is a cyber criminal who waged a sophisticated and orchestrated campaign of online attacks on the computer systems of several major companies," prosecutor for the CPS Organized Crime Division Russell Tyner said in a statement. "These were lawful companies with ordinary customers and hard working employees. This was not a victimless crime."
This court rule came as a part of its ongoing pursuit to strike back at hackers, U.K. courts have convicted a member of Anonymous for conspiracy.
That very cyber attack, for which Christopher Weatherhead has been charged was dubbed "Operation Payback" where Weatherhead and several other Anonymous members targeted those companies that opposed internet piracy, but switched to companies like Mastercard, Visa and PayPal after they refused to process payments to WikiLeaks. Recently in our report, we described that Operation Payback cost a massive damage, for PayPal it cost more than €4.3 million. According to CPS, those campaigns carried by the hacker cost the companies more than $5.6 million in additional staffing, software, and loss of sales. 
The student denied the accusation claiming he was merely an Anonymous chatroom operator and never took part in the attacks. The judge allegedly demanded that Weatherhead provide “as much information as possible” and threatened him with a jail term. The court ruling in Mr. Weatherhead's case will be announced later. 



-Source (Cnet)








 

SHARE OUR NEWS DIRECTLY ON SOCIAL NETWORKS:-

Google Pakistan Hacked & Defaced By Turkish Hacker

Google Pakistan Along With Microsoft  HP, HSBC, Apple, PayPal, Blogspot Hacked & Defaced By Turkish Hacker

Today was most probably the worst day in the history of Pakistan cyber space. Ten big domains of Pakistan has been stroked very badly. Many of you are guessing that it was Indian hackers who cost this damage. But in reality the attack was not generated from India, Bangladesh or such any other native countries,  but it was a Turkish hacker who have reportedly taken down the home and search page of Google Pakistan while leaving an image of two penguins walking across a bridge for million of users. I think now you got that, yes it was Google Pakistan which has been hacked and defaced by a Turkey hacker code named "KriptekS". In the deface page the hacker left several messages in Turkish language, the translation of the text, written on the website, is: "eboz. My homies in a friend always there for me. Have not shot by me with every breath." Also the hacker left a message saying "Pakistan Downed" which is indicating that the home page of Google Pakistan is indeed take down. According to deface mirror on Zone-H, the attack took place around 02:17 in the afternoon, but still, when I am writing this article, the home page of Google Pakistan is still offline. 
May be you are thinking that the story is over, but no; as I told earlier it was the worst day for Pakistani cyber fence, trust me indeed it was. As along with Google, KriptekS, the Turkish hacker also targeted Pakistani domain of Blogger, HSBC, Coca-Cola, Fanta, Paypal, Microsoft, HP & Apple. Also it has been reported that Pakistani domain of Sony, Yahoo & Windows has also been allegedly hacked. And all those hacked domains are still offline. 

List of Hacked Sites:-

http://www.google.com.pk
http://www.google.pk
http://www.hp.com.pk
http://www.apple.pk
http://www.hsbc.pk
http://www.blogspot.pk
http://www.coca-cola.pk
http://www.fanta.pk
http://www.paypal.pk
http://www.microsoft.pk
www.visa.com.pk
www.ebay.pk
www.msn.org.pk
www.sony.pk
www.windows.com.pk
www.yahoo.pk


Deface Mirrors:-

http://zone-h.com/mirror/id/18639529
http://zone-h.com/mirror/id/18639530
http://zone-h.com/mirror/id/18639528
http://zone-h.com/mirror/id/18639527
http://zone-h.com/mirror/id/18638930
http://zone-h.com/mirror/id/18638890
http://zone-h.com/mirror/id/18638879
http://zone-h.com/mirror/id/18638866
http://zone-h.com/mirror/id/18638824
http://zone-h.com/mirror/id/18638825
http://zone-h.com/mirror/id/18638826
http://zone-h.com/mirror/id/18638827
http://zone-h.com/mirror/id/18638828
http://zone-h.com/mirror/id/18638820
http://zone-h.com/mirror/id/18638822
http://zone-h.com/mirror/id/18638823


While talking about this dangerous cyber attack, we would like to remind you that few days ago couple of Pakistani hackers defaced several big Israeli domains including MSN, Bing, Live, Skype, Microsoft Store, BBC, CNN, Coca-Colla, XBOX, Windows, Intel, Philips, Israeli Parliament, Citi Bank and so on. Whether it is not clear that this attack on Pakistan has nay relation with that attack on Israel. But what we can say is that "KriptekS" exactly followed the same path, which Pak hackers shown the world few days ago. 




SHARE OUR NEWS DIRECTLY ON SOCIAL NETWORKS:-

DDoS Attack From Anonymous Cost PayPal £3.5 Million of Damage

DDoS Attack From Anonymous Cost PayPal £3.5 Million of Damage 

The distributed denial of service attack (DDoS) from hacktivist Anonymous has cost PayPal more than €4.3 million. The attack which was named Operation Payback were initially aimed at companies that opposed internet piracy, but switched to companies like Mastercard, Visa and PayPal after they refused to process payments to WikiLeaks. After that attack PayPal -the global leader in online money transfer and payments has paid around £3.5 million defend and arm itself against such kind distributed denial-of-service (DDoS) attacks. In a report BBC said that more than one hundred skilled employees from eBay, PayPal's parent company, spent almost three weeks working on DDoS-attack-related issues and that PayPal had bought software and hardware to defend itself against further attacks. In all, the total cost of this work came to £3.5 million. This details have been revealed in a court case at Southwark Crown Court where a defendant, Christopher Weatherhead (studying at Northampton University when who allegedly took part in the campaign), is facing charges of conspiring to impair the operation of computers. He has pleaded not guilty to conspiring to impair the operation of computers between 1 August 2010 and 22 January 2011.
Sandip Patel, prosecuting, said the group caused PayPal "enormous economic harm". Mr Patel said they used distributed denial of service, or DDoS, which flooded the targets computers with enormous amounts of online requests. Target websites would crash and users would be directed to a page displaying the message: "You've tried to bite the Anonymous hand. You angered the hive and now you are being stung."
Mr Patel said: "This case, simply put, is about hackers who used the internet to attack and disable computer systems - colloquially described as cyber-attackers or vandals." He said Mr Weatherhead, who used the online name Nerdo, posted plans on an Internet Relay Chat (IRC) channel encouraging an attack on PayPal. 
He said PayPal was the victim of a series of attacks "which caused considerable damage to its reputation and loss of trade". 






SHARE OUR NEWS DIRECTLY ON SOCIAL NETWORKS:-

Teen Hacker "Cosmo the God" of Underground Nazi Sentenced 6 Yrs Internet Ban By California Court

Teen Hacker "Cosmo the God" of Underground Nazi Sentenced 6 Yrs Internet Ban By California Court

A teenager hacker from an infamous hacker collective group named Underground Nazi faced Internet ban. On Wednesday the 15 years old hacker known as "Cosmo" or "Cosmo the God" was sentenced in juvenile court in Long Beach, California. According to sources, Cosmo pleaded guilty to multiple felonies in exchange for a probation, encompassing all the charges brought against him, which included charges based on credit card fraud, identity theft, bomb threats, and online impersonation. 
This newly formed hacker group Underground Nazi had taken the spot light in January this year, when they hacked UFC.com (Ultimate Fighting Championship). Later they involved them selves in mass protest against controversial privacy act SOPA & PIPA. The protest was dubbed Operation Megaupload (#OpMegaupload), where hacktivist Anonymous  along with hackers around the globe stand together against the take down of Megaupload.com. In the middle of 2012 Cosmo was also responsible for Twitter outage, where Cosmo along with few other UG Nazi members performed massive denial of service attack to interrupt the service of Twitter. Also it has been found that, Cosmo pioneered social-engineering techniques that allowed him to gain access to user accounts at Amazon, PayPal, and a slew of other companies. He was arrested in June during a part of a multi-state FBI sting. 
Representatives from both the Long Beach district attorney and public defenders offices refused to comment on the case, given Cosmo’s status as a juvenile. However, according to Cosmo, the terms of the plea place him on probation until his 21st birthday. During that time, he cannot use the internet without prior consent from his parole officer. Nor will he be allowed to use the Internet in an unsupervised manner, or for any purposes other than education-related ones. He is required to hand over all of his account logins and passwords. He must disclose in writing any devices that he has access to that have the capability to connect to a network. He is prohibited from having contact with any members or associates of UG Nazi or Anonymous, along with a specified list of other individuals. He had to forfeit all the computers and other items seized in the raid on his home. Also, according to Cosmo, violating any of these terms will result in a three-year prison term. The probationary period lasting until age 21 is standard, but other terms were more surprising.



-Source (Wired) 









SHARE OUR NEWS DIRECTLY ON SOCIAL NETWORKS:-

Pwnium 2: Teenage Hacker Pinkie Pie Exploited Google Chrome & Earned $60,000

Pwnium 2: Teenage Hacker Pinkie Pie Exploited Google Chrome & Earned $60,000

One of world's most popular web-browser Google Chrome has fallen victim at Pwnium 2 security contest which took place earlier on 10th October, at the Hack In The Box conference in Kuala Lumpur, Malaysia. A teenage hacker who goes by the pseudonym "Pinkie Pie" was successfully able to "fully exploit" Chrome, escaping the sandbox using only bugs within Chrome. The hack was done on a fully patched 64-bit Windows 7 system running the latest stable branch of Chrome. For his work, Pinkie Pie will receive the top prize of $60,000 from Google
This isn't the first time that "Pinkie Pie", also the name of a "My Little Pony - Friendship is Magic" character, has won money for exploiting Chrome. In March of this year, he was rewarded for vulnerabilities he used at Google's Pwnium contest, which took place during the Pwn2Own competition at CanSecWest, to break out of the browser's sandbox and execute code. In order to get his code to execute on the test system at the time, he had to combine a total of six vulnerabilities; the holes were later closed with the release of Chrome 18. Along with security specialist Sergey Glazunov, Pinkie Pie also won this year's Pwnie Award for the Best Client-Side Bug. What ever the full results of the Pwnium 2 competition will be announced during a talk by Google Software Engineer Chris Evans today that means, 11th October.
We also like to give you reminder that earlier in this year Google had increased vulnerability bounties in Anniversary of Vulnerability Reward Programbe. Also PayPalFacebook & many other has already started this paid bug bounty program. These bug bounty programs & such security contest indeed enhancing the security. 


-Source (The-H & SC Magazine)






SHARE OUR NEWS DIRECTLY ON SOCIAL NETWORKS:-

WikiLeaks Launches Vote WikiLeaks 2012 Donation Campaign (Presidential Election Intervention)

WikiLeaks Launches Vote WikiLeaks 2012 Donation Campaign (Presidential Election Intervention)

While Barack Obama and Mitt Romney are both rising their chances for the 2012 election as their respective party’s candidates who stood  in the coming US president election. In the mean time  WikiLeaks has launched "Vote WikiLeaks: 2012 Donation Campaign". Through this campaign WikiLeaks has threatened the pentagon once again.  According to the press release of WikiLekas on last Friday - Pentagon spokesman George Little demanded WikiLeaks destroy its publications, including the Iraq War logs which revealed the killings of more than 100,000 civilians. Little said: “continued possession by WikiLeaks of classified information belonging to the United States government represents a continuing violation of law”. The Pentagon also again “warned Mr Assange and WikiLeaks” against “soliciting” material from U.S. military whistleblowers. In response, WikiLeaks has decided to intervene in the U.S. election campaign.
The United States government claims Mr Assange and the WikiLeaks organization are within its jurisdiction. In reply, we place the Obama administration within our jurisdiction. All American school children are taught that being subject to laws without representation is an injustice. This is the backbone of the American Revolution. We claim our representation and now initiate a campaign to transform Democratic and Republican votes into economic and political support for WikiLeaks and its First Amendment values. This election day, do not vote for the Republican or Democratic parties. Instead, cast the only vote that matters. Vote with your wallet – vote for WikiLeaks.
The Democratic Party promised to open government. But instead it is building a state within a state, placing nearly five million Americans under the national security clearance system. It has classified more documents than any previous administration, classifying even the process used to decide who will live and who will be killed. The U.S. administration hurtles towards dystopia: secret laws, secret processes, secret budgets, secret bailouts, secret killings, secret mass spying, secret drones and secret detention without charge. The collapse of the Soviet Union could have led to the withdrawal of the U.S. security state, but without moral competition from another system it has grown unchecked to influence almost every American policy. Four more years in the same direction cannot be tolerated.

Watch WikiLeaks’s Campaign Video below:-


You can donate to WikiLeaks using a variety of easy methods, including workarounds for Visa, MasterCard and PayPal. These donations go to fund WikiLeaks’ publishing and infrastructure costs and our legal costs to fight the financial blockade. For Detailed information about the campaign click Here






SHARE OUR NEWS DIRECTLY ON SOCIAL NETWORKS:-

Google Announced 'Pwnium 2' & Increased Prize Money $2m To Exploit Chrome

Google Announced 'Pwnium 2' & Increased Prize Money $2m To Exploit Chrome

Few days ago we got the result of Microsoft hosted Blue Hat Security contest, where Microsoft awarded a bunch of hackers and gave away an amount of  $260,000. Immediately after this event, Internet giant Google   has upped the ante in its industry-leading cash-for-security-bugs program with hefty bonuses and a hacking contest that will award up to $2 million worth of prizes to people who successfully exploit its Chrome browser. In the official Chromium blog, Google has announced the plan for Pwnium 2. According to a blog post by Chris Evans, Software Engineer at Google- Pwnium 2 will be held on Oct 10th, 2012 at the Hack In The Box 10 year anniversary conference in Kuala Lumpur, Malaysia.
This time, Google be sponsoring up to $2 million worth of rewards at the following reward levels:
  • $60,000: “Full Chrome exploit”: Chrome / Win7 local OS user account persistence using only bugs in Chrome itself. 
  • $50,000: “Partial Chrome exploit”: Chrome / Win7 local OS user account persistence using at least one bug in Chrome itself, plus other bugs. For example, a WebKit bug combined with a Windows kernel bug. 
  • $40,000: “Non-Chrome exploit”: Flash / Windows / other. Chrome / Win7 local OS user account persistence that does not use bugs in Chrome. For example, bugs in one or more of Flash, Windows or a driver. 
  • $Panel decision: “Incomplete exploit”: An exploit that is not reliable, or an incomplete exploit chain. For example, code execution inside the sandbox but no sandbox escape; or a working sandbox escape in isolation. For Pwnium 2, we want to reward people who get “part way” as we could definitely learn from this work. Our rewards panel will judge any such works as generously as we can. 
Exploits should be demonstrated against the latest stable version of Chrome. Chrome and the underlying operating system and drivers will be fully patched and running on an Acer Aspire V5-571-6869 laptop (which we’ll be giving away to the best entry.) Exploits should be served from a password-authenticated and HTTPS Google property, such as App Engine. The bugs used must be novel i.e. not known to us or fixed on trunk. Please document the exploit. 
We also like to give you reminder that earlier in this year Google had increased vulnerability bounties in Anniversary of Vulnerability Reward Programbe. Also PayPal, Facebook & many other has already started this paid bug bounty program.





SHARE OUR NEWS DIRECTLY ON SOCIAL NETWORKS:-

Hacker Are Invited To Attack Facebook's Corporate Network


Hackers Are Invited To Attack Facebook's Corporate Network

Last year the social networking giant, Facebook introduced its bug bounty program, inviting security researchers to poke around the site, discover vulnerabilities that could compromise the integrity or privacy of Facebook user data, and then responsibly disclose them to the company. The minimal reward amount was of $500. White hats were urged to search for Cross-Site Scripting (XSS), Cross-Site Request Forgery (CSRF/XSRF) and Remote Code Injection bugs. In Facebook's White Hat program the company strictly announced that they should not be bothered with spam or social engineering techniques, DoS vulnerabilities, bugs in Facebook's corporate infrastructure and vulnerabilities in third-party websites or apps. Now they changed their mind. When the social network's security team randomly receiving tips from a researcher about a vulnerability in the company's own network which would allow attackers to eavesdrop on internal communications, they made an unprecedented choice by broadened the scope of the bug bounty program and inviting researchers to search for other holes in the Corporate Network. There are quite a few bug bounty programs instituted by tech companies such as Google, Paypal but Facebook has become the first firm that gave formal permission to white hats to target its networks. Ryan McGeehan, the manager of Facebook's security-incident response unit, stated that if there’s a million-dollar bug, they will pay it out.
Given that Facebook has a strong incentive to protect the data belonging to its 900 million users, and the fact that data breaches have become a disturbingly common occurrence in the last two years or so, the step seems like a logical one. 


-Source (Net-Security)





SHARE OUR NEWS DIRECTLY ON SOCIAL NETWORKS:-

Vasilis Pappas Won 'Blue Hat' Security Contest & Grand Prize of $200,000 From Microsoft

Vasilis Pappas Won 'Blue Hat' Security Contest & Grand Prize of $200,000 From Microsoft

Earlier in last year software giant Microsoft started Blue Hat security contest. BlueHat Prize was globally  announced by the company at the 2011 Black Hat security conference in Las Vegas, offers a grand prize of $200,000, a runner-up purse of $50,000, and a third-place award of a one-year subscription to MSDN Universal--a developer's platform for Microsoft products--worth $10,000--to security researchers who design the most effective ways to prevent the use of memory safety vulnerabilities. 
This year Microsoft awarded a bunch of hackers and gave away an amount of  $260,000. 'Hackers' in the good sense here, the clever programmers who won its Blue Hat security contest, including a grand prize of $200,000

The big prize was awarded to a PhD student at Columbia University, Vasilis Pappas, who was handed the check in an American Idol-style contest finale complete with loud music and confetti. The winners were announced during a party at the Black Hat hackers conference 2012 that just happened this week in Las Vegas. Two other guys took home significant prizes, too. Ivan Fratric, a researcher at the University of Zagreb in Croatia, got $50,000 and Jared DeMott, a Security Researcher for Harris Corp. won $10,000.
They all submitted ideas to help solve a really hard security problem called Return-Oriented Programming. ROP is a hacker technique that is often used to disable or circumvent a program's computer security controls. Twenty people submitted ideas in the contest. Without getting into too much technical detail, Pappas came up with something called kBouncer which blocks anything that looks like an ROP attack from running. It's become popular these days to pay security researchers bounties. But what's cool about the Blue Hat contest is that it paid the researcher for actually coming up with a fix to a problem. Not only Microsoft, other compaines- GoogleFacebook, Paypal & many more already have their "Bug Bounty" program, where they reward researchers for simply identifying flaws in thier system. But by contrast Microsoft and Adobe don't pay bounties. Here Microsoft promised that this first Blue Hat prize won't be its last, So this may be a sign of a smart new approach to engaging with security researchers for the software giant. 


-Source (Microsoft & Business Insider)







SHARE OUR NEWS DIRECTLY ON SOCIAL NETWORKS:-

PayPal Announced Paid “Bug Bounty” Program for Security Researchers

PayPal Announced  Paid “Bug Bounty” Program for Security Researchers

Giant in payment services provider PayPal recently announced the launch of a new paid bug bounty program where PayPal will reward security researchers who will discover vulnerabilities in its website with handsome amount of money. In the official blog PayPal's Chief Information Security Officer Michael Barrett said- "The security of our customers’ data is our number one priority" Its very obvious and clear that while enhancing more security PayPal took this step because we all know that PayPal is listed among those sites where cyber-criminals always kept their eyes. 
If you are a security researcher, and you've discovered a site or product vulnerability, please forward your details to sitesecurity@paypal.com. We also like to give you reminder that before PayPal- Facebook, Google & many other has already started this paid bug bounty program.

-:PayPal Bug Bounty Program In Details:-
  • PayPal security team will determine the bounty amount and all decisions are final. 
  • Bounty is awarded to the first person that discovers the previously unknown bug.
  • The bug bounty program is subject to change or to cancellation at any point without notice.
  • Payment is paid out through a verified PayPal account, once the bug is fixed.
  • For all submissions, do not send personal information in your report and please use PayPal's PGP key to encrypt your email.
  • Individuals from sanctioned countries are not allowed to participate in this program.
  • eBay Inc. employees, contractors and their immediate relatives are not allowed to participate in the program.
Vulnerabilities That Are in Scope:
  • XSS
  • CSRF/XSRF
  • SQLi
  • Authentication bypass
Note: While "Logout CSRF" is a well-acknowledged issue, there are other techniques  like "cookie forcing" and "cookie bombardment" that can make it futile to defend against this attack. Also, PayPal's web sessions are relatively short lived and hence the Bug Bounty panel will not consider reports of the ability to log out users from PayPal as qualifying for the reward.
In Your Bug Submission Email, Please Include The Following:
  • Your email address
  • Your PayPal account (in order to receive the bounty)
  • Vulnerability type (i.e., XSS, CSRF, SQLi, etc.)
  • Vulnerability Scope: Domain(s), URL(s) and Parameter(s) impacted
  • Steps to reproduce bug
Guidelines for Responsible Disclosure
  • Share the security issue with us before making it public on message boards, mailing lists, and other forums.
  • Allow us reasonable time to respond to the issue before disclosing it publicly.
  • Provide full details of the security issue.
Terms for Participation :- As between eBay Inc. and the Submitter, as a condition of participation in the PayPal Bug Bounty program, the Submitter grants eBay Inc., its affiliates and customers a perpetual, irrevocable, worldwide, royalty-free and non-exclusive license to use, reproduce, adapt, modify, publish, distribute, publicly perform, create derivative work from, make, use, sell, offer for sale and import the Submission for any purpose. Submitter represents and warrants that the Submission is original to the Submitter and Submitter owns all rights, title and interest in and to the Submission. Submitter waives all other claims of any nature, including express contract, implied-in-fact contract, or quasi-contract, arising out of any disclosure of the Submission to eBay. In no event shall eBay be precluded from discussing, reviewing, developing for itself, having developed, or developing for third parties, materials which are competitive with those set forth in the Submission irrespective of their similarity to the information in the Proposal, so long as eBay complies with the terms of participation stated herein. 

For additional information click Here





SHARE OUR NEWS DIRECTLY ON SOCIAL NETWORKS:-

Edward Pearson Sent To Jail For Stealing 8Million Customers Banking & PayPal Details

Edward Pearson (23 Years Aged Hacker) Sent To Jail For Stealing 8Million Customers Banking & PayPal Details

A 23 years aged hacker from UK named Edward Pearson has been sent to prison to pilfer eight million personal identities (ID fraud). Between January 1 2010 and August 30 2011, he used of malicious computer programs to get his hands on - wait for it - eight MILLION personal identities. According to report he used highly sophisticated cyber-weapons such as Zeus and SpyEye, to hunt down personal details on the Internet. 
One of his programs scanned through 200,000 accounts registered to online payment service PayPal - identifying names, passwords and current balances. Luckily, Pearson got caught after only making a £2,400 ($3,800 USD). The authorities estimate he could have walked away with as much as £800,000 ($1.3M USD).  Authorities were alerted to the problem when his 21-year-old girlfriend, Cassandra Mennim, used stolen credit cards to book rooms at the upmarket Cedar Court Grand and Lady Anne Middleton Hotels. Investigators looking into the case eventually identified him as G-Zero on hacking forms. Pearson has been jailed for 26 months, whilst girlfriend Cassandra Mennim admitted two counts of obtaining services dishonestly and was given 12 months’ supervision.


-Source (NS & DailyMail)


SHARE OUR NEWS DIRECTLY ON SOCIAL NETWORKS:-

Single Sig-on (SSO) Service Is Vulnerable (Google, Paypal, Facebook, Twitter Users At Risk)

Single Sig-on (SSO) Service Is Vulnerable (Google, Paypal, Facebook, Twitter Users At Risk)
Serious security flaws has been found in Web-based single sign-on (SSO) services run by Google, Paypal, Facebook, Twitter, and many others. It has been suspected that executing the vulnerability an attacker can get access to users' accounts. Researchers at Microsoft and Indiana University recently recently discovered this loop hole. The security researchers have made an exclusive report which clearly indicates poor integration by website developers of the application programming interfaces and a lack of end-to-end security checks as the reasons for the flaws.  According to the report :- “In this study, we discovered eight serious logic flaws in high-profile ID providers and relying party websites, such as OpenID (including Google ID and PayPal Access), Facebook, JanRain, Freelancer, FarmVille, Sears.com, etc. Every flaw allows an attacker to sign in as the victim user. We reported our findings to affected companies, and received their acknowledgements in various ways”. 
Although the flaws have been fixed by the affected companies, “this study shows that the overall security quality of SSO deployments seems worrisome”, they noted. 




SHARE OUR NEWS DIRECTLY ON SOCIAL NETWORKS:-

Federal Judge Opened The Gate For 14 Anonymous Members To Use Twitter

Federal Judge Opened The Gate For 14 Anonymous Members To Use Twitter Freely

A Federal judge in San Jose, Calif. Has opened the gates for 14 alleged members of anonymous to continue using Twitter as one of the "principle tools through which the members of the Anonymous hacking group planned and coordinated their criminal activities," according to prosecutors opposing the decision. The first question came up in January as a motion from Vincent Kershaw, indicted along with 13 other alleged Anon members for attacking PayPal following the arrest of WikiLeaks founder Julian Assange.
Kershaw could have simply argued that preventing him from Tweeting about issues having nothing to do with his legal situation or the charges against him was a violation of his First Amendment right to free speech. Even in court, where current events, fashions and politics are supposed to be banished from legal decisions, requests go over much more easily when they hit the issues that are big today rather than when the Constitution was written.
Despite arguments that the dangerous, subversive hackers of Anonymous use the overly public Twitter to plan their misdeeds, Judge Paul Grewal ruled prosecutors hadn't sufficiently linked specific Twitter accounts to their assumption that every key-press by an Anonymous sympathizer was necessarily a felony or act of treason.
Therefore Kershaw and his fellow defendants are free to Tweet themselves or participate in Twitter Town Halls and other online events. They're not allowed to use IRC, however, which Anonymous actually does use to plan and coordinate its various activities, not to mention gossip about each other, engage in private flame wars that break out into public doxings, swap files, swap pictures and do all the other social things people do online, especially when their physical liberty is limited.
Kershaw is a 28-year-old foreman for a Colorado landscaping company, was arrested along with 15 others for a DDOS attack the DoJ charges they participated in and which was organized by Anonymous. He was released July 2 on a bond of $10,000 on condition he not access the Internet from any computer and that he allow a probation officer to verify he had not done so.



SHARE OUR NEWS DIRECTLY ON SOCIAL NETWORKS:-

Flashback.G Trojan Targeting Mac Users While Stealing Passwords

 Flashback.G Trojan Targeting Mac Users While Stealing Passwords
Remember earlier MAC Security Blog reported that the latest version, Flashback.D, has gotten a bit sneakier. First, it checks to see if the user is running Mac OS X in VMware Fusion. If so, it does not execute. It does this because many malware researchers test malware in virtual machines, rather than infect full installations, as it is easier to delete them and start over with clean copies. This means that security researchers analyzing and looking for this malware need to be running regular Macs.
 Yet again Mac users became the victim of another trojan. This new Trojan virus is capable of infecting their computers and stealing passwords to services such as Google, PayPal, online banking & so on. This virus is using a new installation method When a user visits a crafted web page, the new variant either tries to exploit two old security vulnerabilities or deploys a Java Applet which tries to trick the user into believing it has been certified by Apple. According to Mac Security Blog (Intego):- This new variant of the Flashback Trojan horse uses three methods to infect Macs. The malware first tries to install itself using one of two Java vulnerabilities. If this is successful, users will be infected with no intervention. If these vulnerabilities are not available – if the Macs have Java up to date – then it attempts a third method of installation, trying to fool users through a social engineering trick. The applet displays a self-signed certificate, claiming to be issued by Apple. Most users won’t understand what this means, and click on Continue to allow the installation to continue.
It is worth noting that Flashback.G will not install if VirusBarrier X6 is present, or if a number of other security programs are installed on the Mac in question. It does this to avoid detection. It seems that the malware writers feel it is best to avoid Macs where the malware might be detected, and focus on the many that aren’t protected.
Earlier also Mac users faced such attacks where OSX/Revir-B trojan was installed behind a PDF, and giving hackers remote access to MAC computers, not only Revier-B also Linux Tsunami trojan Called "Kaiten" targeted Mac OS users in 2011. Also another malware named "Devil Robber" which was also make MAC users victim while stealing their personal informations.



SHARE OUR NEWS DIRECTLY ON SOCIAL NETWORKS:-

FBI Gave Warning To Hacktivists: You're Breaking The Law


FBI official in charge of cybercrime speaks for the first time with the media specifically about hacktivism. Last July, the FBI executed what is arguably its most public campaign against hacktivists—individuals who breach computer systems to make a political or ideological statement. On Tuesday, July 19, the G-men cuffed 12 men and two women allegedly associated with hacktivist group Anonymous for their supposed involvement in a dedicated denial of service (DDoS) attack against PayPal's website in December 2010. The July raid appeared to be the largest public indication that the FBI was finally making headway in its investigation of hacktivist activity during a year when groups including Anonymous and LulzSec made a mockery of public- and private-sector computer systems. Between December 2010 and August 2011 alone, they broke into dozens of corporate and government networks with outrage, defiance and glee. In fact, hacktivist activity had long been on the FBI's radar, according to Shawn Henry, executive assistant director of the FBI's Criminal, Cyber, Response and Services Branch. He first noticed it in the late 1990s, when he was working as a supervisory special agent at FBI headquarters on computer intrusion cases. At the time, hacktivism consisted mostly of website defacements, he says. Today, it's more menacing. Consider the outcomes of just three data breaches launched in the name of hacktivism.


SHARE OUR NEWS DIRECTLY ON SOCIAL NETWORKS:-

Cyber Criminals Targeting Paypal Via Spamming


Paypal again under cyber attack. This time spammers hit paypal very hard. The issue over here is that Paypal is saying or you can say the spam mail containing that Your email address has been changed. Attached to the email is an HTML form (Personal Profile Form - PayPal-.htm), that requests you enter your personal information. Of course, the email is not really from PayPal (who would never send you an HTML form via email anyway), and any information you enter will soon be in the hands of phishing cybercriminals.

Typical Spam Looks Like:-

Subject: You have changed your PayPal email address
Attachment: Personal Profile Form - PayPal-.htm
Message body:

Dear PayPal Customer,

You have added [EMAIL ADDRESS] as a new email address for your Paypal account.
If you did not authorize this change, check with family members and others who may have access to your account first. If you still feel that an unauthorized person has changed your email, submit the form attached to your email in order to keep your original email and restore your Paypal account.
NOTE: The form needs to be opened in a modern browser which has javascript enabled (ex: Internet Explorer 7, Firefox 3, Safari 3, Opera 9)
Please understand that this is a security measure intended to help protect you and your account. We apologize for any inconvenience.
If you choose to ignore our request, you leave us no choice but to temporary suspend your account.
Sincerely, PayPal Account Review Department.

Immediately after this phenomena Paypal takes stpes. They are asking you to forward the mail to the security Team.   To know the official advice of Paypal click Here. To prevent this Paypal released security measures. More info Have a look 


  

SHARE OUR NEWS DIRECTLY ON SOCIAL NETWORKS:-

Related Posts Plugin for WordPress, Blogger...