Showing posts sorted by date for query Visa. Sort by relevance Show all posts
Showing posts sorted by date for query Visa. Sort by relevance Show all posts

Master Card Blog Hacked & defaced By Syrian Electronic Army

Master Card Payments Perspectives Blog Hacked & defaced By Syrian Electronic Army

It's became a very common scenario that hackers targets banks, payment gateway and other financial sectors. Sites like Paypal, Visa, Master Card were among those common victims who used to face massive round of cyber attacks. Past two years hacktivist managed to interrupt the service of those websites many times. Here also in the beginning of 2013 almost same situation took place, when the official blog of Master Card get hacked and defaced.  It was the Saturday evening when a hackers collective group named "Syrian Electronic Army" managed to breach and get access inside Master Card blog. I am sure that all our readers will be shocked after hearing the way of intrusion. In the platform of the blog, Master Card was using an older version of WordPress (Ver. 3.3.2) which has several critical vulnerabilities like XSS, file uploading, CSRF and so on. Exploiting those loopholes the hacker managed to get access inside the blog and defaced one of the page of the giant in international financial services company's blog. Though WordPress have released a security patch and also version 3.5, but it's quite unfortunate and shocking that Master Card did not even patched their older version for which their system get penetrated. It is truly unbelievable that sites like Master Card is so careless about basic security and counter measure of cyber attack. According to sources Syrian Electronic Army used  the CSRF exploit of WordPress which is said to be available on the Internet and allows an attacker to add a new administration user. This is a possible explanation of how the Syrian Electronic Army managed to hack and deface the blog. After this incident occurs Master Card immediately updated the version of WP and closed those back doors. Still the the defaced and cached version of the  blog can be viewed on Google’s Web Cache







SHARE OUR NEWS DIRECTLY ON SOCIAL NETWORKS:-

Two Nigerians Arrested For Hacking into Mail Servers of Ghana Armed Force & Stealing $13,978

Two Nigerians Arrested For Hacking into Mail Servers of Ghana Armed Force & Stealing $13,978

Two middle aged Nigerians have been arrested for hacking into mail server of Ghana Armed Force (GAF). The suspects, Peter Okechukwu, 32, and Emmanuel Ifedi, 31, were arrested by officials of the Criminal Investigations Department (CID) of the Ghana Police Service at a branch of the United Bank of Africa (UBA). In a report Ghana Business News said-  these two cyber criminal get busted in Accra  while attempting to divert $13,978 belonging to, Ghanaian peacekeepers after they had succeeded in hacking into the e-mails of GAF. According to the Director-General of the CID, Commissioner of Police Mr Prosper Agblor, in November this year the two suspects managed to enter the e-mails of Continental African Trading Limited (CATAL) and the United Nations Interim Force in Lebanon (UNIFIL) GHANBATT 76 and intercepted all electronic communications between the two parties. CATAL, an international organisation, had been supplying home appliances' to Ghanaian peacekeeping troops on various missions at different locations in the world. 
Recently, CATAL was contacted, as usual, by the GAF to supply home appliances to UNIFIL GHANBATT 76 peacekeeping troops in Lebanon. Mr Agblor said there was correspondence concerning the supply of the items between CATAL and the military through the Internet. Along the line, he said, the e-mails between the GAF and CATAL were hacked into by the two Nigerians, who intercepted all mails from both ends and replied them as if the replies were coming from the rightful receivers of the e-mails. 
He said the two suspects, using the identity of CATAL, sent an e-mail to the GAF instructing it to pay $13,978 into a UBA account number 01011651102235 as part payment for the supply of the goods. Upon receipt of the information, the GAF transferred $13,978 into the account as instructed by the two suspects.
Mr Agblor said CATAL realized that the GAF had suddenly stopped communicating with the company on matters relating to the transfer of the money and so it followed up with a phone call and detected that the GAF had paid $13,978 into an account number supplied by CATAL. 
He said it was at that stage that the two organisations realised that someone had hacked into their e-mails and quickly reported the issue to the Documentation and Visa Fraud Unit of the CID. Mr Agblor said the Business Development Manager of CATAL reported the case to the police and checks at the bank revealed that the money had not yet been cashed by the suspects. The police quickly mounted surveillance at the bank, awaiting the arrival of the suspects to cash the money. 
According to the CID boss, on November 11, 2012, Okechukwu, who happened to be the owner of the said account, was arrested when he turned up at the bank to cash the amount. Upon interrogation, the police said, Okechukwu admitted to the offence but mentioned Ifedi as the master brain behind the whole deal and led the police to Ifedi's house at Ashaley Botwe, an Accra suburb. Mr Agblor said investigations were still ongoing, after which the two would be put before court.






SHARE OUR NEWS DIRECTLY ON SOCIAL NETWORKS:-

British Court Convicts Anonymous Hacker "Nerdo" For DDoS Attack Over WikiLeaks Funding

British Court Convicts Anonymous Hacker "Nerdo" For DDoS Attack Over WikiLeaks Funding

Another alleged Anonymous hacker faced cour rule. A British court has convicted a 22-year-old for allegedly being a ‘key figure’ behind Anonymous DDoS attack on PayPal in revenge for its freezing WikiLeaks payments. A 22-year-old British student Christopher Weatherhead, self described "hacktivist", going by the name of "Nerdo" was convicted by the jury on a count of conspiracy to impair computer operations. The conviction came after guilty pleas of three of Weatherhead's co-conspirators.
"Christopher Weatherhead is a cyber criminal who waged a sophisticated and orchestrated campaign of online attacks on the computer systems of several major companies," prosecutor for the CPS Organized Crime Division Russell Tyner said in a statement. "These were lawful companies with ordinary customers and hard working employees. This was not a victimless crime."
This court rule came as a part of its ongoing pursuit to strike back at hackers, U.K. courts have convicted a member of Anonymous for conspiracy.
That very cyber attack, for which Christopher Weatherhead has been charged was dubbed "Operation Payback" where Weatherhead and several other Anonymous members targeted those companies that opposed internet piracy, but switched to companies like Mastercard, Visa and PayPal after they refused to process payments to WikiLeaks. Recently in our report, we described that Operation Payback cost a massive damage, for PayPal it cost more than €4.3 million. According to CPS, those campaigns carried by the hacker cost the companies more than $5.6 million in additional staffing, software, and loss of sales. 
The student denied the accusation claiming he was merely an Anonymous chatroom operator and never took part in the attacks. The judge allegedly demanded that Weatherhead provide “as much information as possible” and threatened him with a jail term. The court ruling in Mr. Weatherhead's case will be announced later. 



-Source (Cnet)








 

SHARE OUR NEWS DIRECTLY ON SOCIAL NETWORKS:-

Google Pakistan Hacked & Defaced By Turkish Hacker

Google Pakistan Along With Microsoft  HP, HSBC, Apple, PayPal, Blogspot Hacked & Defaced By Turkish Hacker

Today was most probably the worst day in the history of Pakistan cyber space. Ten big domains of Pakistan has been stroked very badly. Many of you are guessing that it was Indian hackers who cost this damage. But in reality the attack was not generated from India, Bangladesh or such any other native countries,  but it was a Turkish hacker who have reportedly taken down the home and search page of Google Pakistan while leaving an image of two penguins walking across a bridge for million of users. I think now you got that, yes it was Google Pakistan which has been hacked and defaced by a Turkey hacker code named "KriptekS". In the deface page the hacker left several messages in Turkish language, the translation of the text, written on the website, is: "eboz. My homies in a friend always there for me. Have not shot by me with every breath." Also the hacker left a message saying "Pakistan Downed" which is indicating that the home page of Google Pakistan is indeed take down. According to deface mirror on Zone-H, the attack took place around 02:17 in the afternoon, but still, when I am writing this article, the home page of Google Pakistan is still offline. 
May be you are thinking that the story is over, but no; as I told earlier it was the worst day for Pakistani cyber fence, trust me indeed it was. As along with Google, KriptekS, the Turkish hacker also targeted Pakistani domain of Blogger, HSBC, Coca-Cola, Fanta, Paypal, Microsoft, HP & Apple. Also it has been reported that Pakistani domain of Sony, Yahoo & Windows has also been allegedly hacked. And all those hacked domains are still offline. 

List of Hacked Sites:-

http://www.google.com.pk
http://www.google.pk
http://www.hp.com.pk
http://www.apple.pk
http://www.hsbc.pk
http://www.blogspot.pk
http://www.coca-cola.pk
http://www.fanta.pk
http://www.paypal.pk
http://www.microsoft.pk
www.visa.com.pk
www.ebay.pk
www.msn.org.pk
www.sony.pk
www.windows.com.pk
www.yahoo.pk


Deface Mirrors:-

http://zone-h.com/mirror/id/18639529
http://zone-h.com/mirror/id/18639530
http://zone-h.com/mirror/id/18639528
http://zone-h.com/mirror/id/18639527
http://zone-h.com/mirror/id/18638930
http://zone-h.com/mirror/id/18638890
http://zone-h.com/mirror/id/18638879
http://zone-h.com/mirror/id/18638866
http://zone-h.com/mirror/id/18638824
http://zone-h.com/mirror/id/18638825
http://zone-h.com/mirror/id/18638826
http://zone-h.com/mirror/id/18638827
http://zone-h.com/mirror/id/18638828
http://zone-h.com/mirror/id/18638820
http://zone-h.com/mirror/id/18638822
http://zone-h.com/mirror/id/18638823


While talking about this dangerous cyber attack, we would like to remind you that few days ago couple of Pakistani hackers defaced several big Israeli domains including MSN, Bing, Live, Skype, Microsoft Store, BBC, CNN, Coca-Colla, XBOX, Windows, Intel, Philips, Israeli Parliament, Citi Bank and so on. Whether it is not clear that this attack on Pakistan has nay relation with that attack on Israel. But what we can say is that "KriptekS" exactly followed the same path, which Pak hackers shown the world few days ago. 




SHARE OUR NEWS DIRECTLY ON SOCIAL NETWORKS:-

DDoS Attack From Anonymous Cost PayPal £3.5 Million of Damage

DDoS Attack From Anonymous Cost PayPal £3.5 Million of Damage 

The distributed denial of service attack (DDoS) from hacktivist Anonymous has cost PayPal more than €4.3 million. The attack which was named Operation Payback were initially aimed at companies that opposed internet piracy, but switched to companies like Mastercard, Visa and PayPal after they refused to process payments to WikiLeaks. After that attack PayPal -the global leader in online money transfer and payments has paid around £3.5 million defend and arm itself against such kind distributed denial-of-service (DDoS) attacks. In a report BBC said that more than one hundred skilled employees from eBay, PayPal's parent company, spent almost three weeks working on DDoS-attack-related issues and that PayPal had bought software and hardware to defend itself against further attacks. In all, the total cost of this work came to £3.5 million. This details have been revealed in a court case at Southwark Crown Court where a defendant, Christopher Weatherhead (studying at Northampton University when who allegedly took part in the campaign), is facing charges of conspiring to impair the operation of computers. He has pleaded not guilty to conspiring to impair the operation of computers between 1 August 2010 and 22 January 2011.
Sandip Patel, prosecuting, said the group caused PayPal "enormous economic harm". Mr Patel said they used distributed denial of service, or DDoS, which flooded the targets computers with enormous amounts of online requests. Target websites would crash and users would be directed to a page displaying the message: "You've tried to bite the Anonymous hand. You angered the hive and now you are being stung."
Mr Patel said: "This case, simply put, is about hackers who used the internet to attack and disable computer systems - colloquially described as cyber-attackers or vandals." He said Mr Weatherhead, who used the online name Nerdo, posted plans on an Internet Relay Chat (IRC) channel encouraging an attack on PayPal. 
He said PayPal was the victim of a series of attacks "which caused considerable damage to its reputation and loss of trade". 






SHARE OUR NEWS DIRECTLY ON SOCIAL NETWORKS:-

WikiLeaks Launches Vote WikiLeaks 2012 Donation Campaign (Presidential Election Intervention)

WikiLeaks Launches Vote WikiLeaks 2012 Donation Campaign (Presidential Election Intervention)

While Barack Obama and Mitt Romney are both rising their chances for the 2012 election as their respective party’s candidates who stood  in the coming US president election. In the mean time  WikiLeaks has launched "Vote WikiLeaks: 2012 Donation Campaign". Through this campaign WikiLeaks has threatened the pentagon once again.  According to the press release of WikiLekas on last Friday - Pentagon spokesman George Little demanded WikiLeaks destroy its publications, including the Iraq War logs which revealed the killings of more than 100,000 civilians. Little said: “continued possession by WikiLeaks of classified information belonging to the United States government represents a continuing violation of law”. The Pentagon also again “warned Mr Assange and WikiLeaks” against “soliciting” material from U.S. military whistleblowers. In response, WikiLeaks has decided to intervene in the U.S. election campaign.
The United States government claims Mr Assange and the WikiLeaks organization are within its jurisdiction. In reply, we place the Obama administration within our jurisdiction. All American school children are taught that being subject to laws without representation is an injustice. This is the backbone of the American Revolution. We claim our representation and now initiate a campaign to transform Democratic and Republican votes into economic and political support for WikiLeaks and its First Amendment values. This election day, do not vote for the Republican or Democratic parties. Instead, cast the only vote that matters. Vote with your wallet – vote for WikiLeaks.
The Democratic Party promised to open government. But instead it is building a state within a state, placing nearly five million Americans under the national security clearance system. It has classified more documents than any previous administration, classifying even the process used to decide who will live and who will be killed. The U.S. administration hurtles towards dystopia: secret laws, secret processes, secret budgets, secret bailouts, secret killings, secret mass spying, secret drones and secret detention without charge. The collapse of the Soviet Union could have led to the withdrawal of the U.S. security state, but without moral competition from another system it has grown unchecked to influence almost every American policy. Four more years in the same direction cannot be tolerated.

Watch WikiLeaks’s Campaign Video below:-


You can donate to WikiLeaks using a variety of easy methods, including workarounds for Visa, MasterCard and PayPal. These donations go to fund WikiLeaks’ publishing and infrastructure costs and our legal costs to fight the financial blockade. For Detailed information about the campaign click Here






SHARE OUR NEWS DIRECTLY ON SOCIAL NETWORKS:-

Donations Reopened- WikiLeaks Opens New Path Through Banking Siege

Donations Reopened- WikiLeaks Opens New Path Through Banking Siege  

After the court victory against the financial blockade imposed by Visa and MasterCard to WikiLeaks donation, now WikiLeaks is opening a new path  in its battle to breakthrough the banking siege. In early Wednesday morning, WikiLeaks announced  via its twitter feed while saying it could now accept donations through a French non-profit. 
"After almost two years of fighting an unlawful banking blockade by US financial giants VISA and MasterCard, WikiLeaks has announced it is back open for donations. After WikiLeaks’ publications revealing US war crimes and statecraft in 2010, US financial institutions erected a banking blockade against WikiLeaks wholly outside of any judicial or administrative process. The blockade came during a time of substantial economic growth for WikiLeaks but blocked more than 95% of donations, costing the organization in excess of USD 20 million.
The Wau Holland Transparency Reports for WikiLeaks’ finances, released today, illustrate the financial consequences of 18 consecutive months of economic censorship. For the year 2011, the blockade resulted in WikiLeaks’ income falling to just 21% of its operating costs. WikiLeaks has been forced to run on its cash reserves at the Wau Holland Foundation, which have diminished from EUR 800,000 at the end of December 2010, to less than EUR 100,000 at the end of June 2012. As the graph shows, WikiLeaks’ reserve funds will expire at the current austere rate of expenditure within a few months. In order to effectively continue its mission, WikiLeaks must raise a minimum of EUR 1 million immediately.
Against this background, WikiLeaks is launching a new payment gateway, designed to work around the blockade. The French credit card system, Carte Bleue, is coupled with the VISA/MasterCard system globally. VISA and MasterCard are contractually barred from directly cutting off merchants through the Carte Bleue system. The French non-profit FDNN (Fund for the Defense of Net Neutrality- Fonds de Défense de la Net Neutralité) has set up a Carte Bleue fund for WikiLeaks.
WikiLeaks advises all global supporters to make use of this avenue immediately before VISA/MasterCard attempts to shut it down.
However, WikiLeaks and FDNN are ready for the fight. Julian Assange, WikiLeaks’ founder said: "We beat them in Iceland and, by God, we’ll beat them in France as well. Let them shut it down. Let them demonstrate to the world once again their corrupt pandering to Washington. We’re waiting. Our lawyers are waiting. The whole world is waiting. Do it."

NEW LINKS FOR DONATION:-

FDNN-WikiLeaks Payment Gateway (Donate here): https://shop.wikileaks.org/donate#dccard
















SHARE OUR NEWS DIRECTLY ON SOCIAL NETWORKS:-

WikiLeaks Get Court Victory, Donations By Visa & MasterCard May Resume Soon

WikiLeaks Get Court Victory, Donations By Visa & MasterCard May Resume Soon

Court victory to WikiLeaks, this Thursday an Icelandic court declared victory in the first round of its campaign against the financial blockade imposed by Visa and MasterCard to WikiLeaks donation. Judge ruled 'Valitor' -Icelandic payments processor to reopen a gateway handling Visa and MasterCard donations to Wikileaks. The court ruled that Valitor must resume processing payments for Wikileaks' partner DataCell within two weeks. If Valitor doesn't, then it must pay a fine of 800,000 Icelandic kronur (USD$6,200) per day until the company complies with the ruling, the Reykjavik district court ruled. 
WikiLeaks says that the ensuing blockade has led to a 95 percent fall in revenue, something which founder Julian Assange says has forced him to focus on fundraising at the expense of his site's publication work.
The judgment, handed down by Reykjavik District Court, is "a very important milestone in our campaign," WikiLeaks spokesman Kristinn Hrafnsson said in a telephone interview. Lawsuits remain active in Denmark and in Belgium, he said, but the Icelandic win was "a small but very important step in fighting back against these powerful banks."
DataCell CEO Andreas Fink said the court had dismissed Visa's argument that DataCell should not be allowed to process donations for third parties.
"The verdict is an important one as the court had to rule on the conditions of the contracts we had with a payment processor which indirectly imposes Visa general rules on us," said Fink. 
Still neither Visa Inc. nor MasterCard Inc. immediately returned emails seeking comment on the judgment.



-Source (Newsday & PCW)





SHARE OUR NEWS DIRECTLY ON SOCIAL NETWORKS:-

Global Payments Inc -Security Breach Compromised 1.5 Million of Visa and MasterCard

Global Payments Inc -Security Breach Compromised 1.5 Million of Visa and MasterCard

Earlier in this year cyber criminals had breached the security system Global Payments Inc. a leader in payment processing services. During breach experts have estimated that more than 50,000 Visa and MasterCard information was stolen. And now after the investigation Global Payments says that no more than 1.5 million credit card numbers were harvested during the intrusion into its systems disclosed earlier this year. The incident only affects North American Visa and MasterCard customers. The Company has, however, provided a larger quantity of card numbers to industry brands to enable them to proactively monitor cardholder activity.  The evidence continues to indicate that the potential card exportation was limited to Track 2 data. 

This type of track data on the magnetic stripe of a credit card includes numerical data such as the card number and the expiry date but doesn't include information like the card owner's name.
Additionally, Global Payments says that it believes that not all of the nearly 1.5 million cards have been compromised. However, the payment processing company has notified credit card companies of all potentially affected numbers so that they can "proactively monitor cardholder activity"; Global Payments has previously said that it might pass on further card numbers for monitoring purposes. Paul R. Garcia, the Chairman and CEO of Global Payments, has apologised for the incident and said that his company is working diligently to conclude its investigations. At the end of its fiscal year in July, the company plans to present its shareholders with a final report on the incident. Once investigations are complete, the payment processing firm plans to reapply as a "PCI DSS Compliant Service Provider" with MasterCard and Visa: after the incident was made public, the credit card companies revoked Global Payments' certification.





SHARE OUR NEWS DIRECTLY ON SOCIAL NETWORKS:-

Global Payment company Visa Conducted Security Training For CBI Officials

Global Payment company Visa Conducted Security Training For CBI Officials To Fight Against Cyber-Crime
Global Payment company Visa has sensitized officials from the Central Bureau of Investigation (CBI) about modus operandi of electronic payment frauds and measures to combat the rising cyber-crime. This whole campaign was a part of spreading awareness on changing nature of cyber crime and card frauds in India. Visa conducted a workshop in New Delhi where CBI officials of economic offence wing were given information on global trends in fraud risk management, cybercrime and measures available to detect and combat them. The company said that given the rapidly changing nature of cybercrime and card fraud in India, the objective of the awareness programme was to share the modus operadi of electronic payment frauds and the intricacies involved in them. 
Visa said it has stepped up its electronic payments security awareness initiative with a Cards Fraud and Payments Risk Awareness Programme for Indian law enforcement agencies.
"This programme has been developed in response to growing government and public concerns around increased fraud exposures around electronic payment products, cyber security and cyber crime," it said in a statement. Visa Group Country Manager (India and South Asia) Uttam Nayak said the company is committed to developing a safe and secure online experience. "Through such programmes we play our part in keeping the country's payment system safe and ensure that law enforcement agencies have the latest skills at their disposal," he said.
VK Gupta, Special Director of CBI said that as a law enforcement agency, it is critical to understand the evolving cybercrime landscape and the latest technology used to track and prevent criminal activities.
-Source (Money Life)



SHARE OUR NEWS DIRECTLY ON SOCIAL NETWORKS:-

Global Payments Hacked, 50K Cardholders At Risk (Visa & MasterCard Investigating The Breach)


Global Payments
Hacked, 50K Cardholders At Risk (Visa & MasterCard Investigating The Breach)

A security breach at Global Payments Inc, a third-party U.S. based processor, may have compromised 
50,000 Visa and MasterCard cardholder accounts. Both Visa and MasterCard have sent out non-public alerts to banks notifying them of the breach.
Major credit card issuing agencies have alerted customers and asserted that their own systems are still secure. MasterCard has hired an independent data security firm to look into the hack, while Visa has given the affected account number to the banks so that steps can be taken to protect those customers and to help find the hacker. However, the breach affects all major credit card brands, including Discover and American Express.
Visa and MasterCard are investigating whether a data security breach at one of the main companies that processes transactions improperly exposed private customer information, bank officials said Friday. The event highlighted a crucial vulnerability that could affect millions of credit card holders. The breach occurred at Global Payments, an Atlanta company that helps Visa and MasterCard process transactions for merchants. One bank executive estimated that about one million to three million accounts could be affected. That does not mean that all those cards were used fraudulently, but that credit card information on the cardholders was exposed. The bank official, who insisted on anonymity because the inquiry is at an early stage, said that Visa and MasterCard notified his company on Thursday, but that banks had been frustrated with the pace of disclosure by Global Payments. He said that Global Payments, which is one of the biggest transactions processors, had provided little information on where the breaches took place, how accounts were hacked and other details that could indicate which customers might be vulnerable. This is the second breach at Global Payments in the last 12 months, according to two individuals briefed on the investigations who spoke on condition of anonymity because they were not authorized to speak publicly. Another similar attack was disclosed by Heartland Payment Systems in 2009, a breach that began in 2007 and resulted in the exposure of data on 130 million credit cards. Heartland estimated that breach cost it $140 million in fines, settlements and legal fees.
If you use a Visa or MasterCard credit card, you may be affected by this breach. The good news is that most credit cards have fraud protection, so even if you are affected by this security breach, you most likely will not be affected by fraudulent charges if you catch them early enough.




SHARE OUR NEWS DIRECTLY ON SOCIAL NETWORKS:-

Acunetix Web Vulnerability Scanner 8 BETA Arrived

One of the worlds famous web vulnerability scanner Acunetix has released their next version WVS 8 BETA. Many of you have been biting their nails in anticipation of this Beta, so sit tight and read on for the next most important stage in the evolution of Acunetix WVS.  Version 8 of Web Vulnerability Scanner has been optimized to make life easier at every stage of a security scan. WVS is easier to use for web admins and security analysts alike: enhanced automation, ability to save scan settings as a template to avoid reconfiguration, and multiple instance support for simultaneous scans of several websites. WVS 8 also ushers in a new exciting co-operation between Acunetix and Imperva: developers of the industry’s leading Web Application Firewall.

Some Improved Features:-    
  • AcuSensor Technology
  • An automatic client script analyzer allowing for security testing of Ajax and Web 2.0 applications
  • Industries' most advanced and in-depth SQL injection and Cross site scripting testing
  • Advanced penetration testing tools, such as the HTTP Editor and the HTTP Fuzzer  
  • Visual macro recorder makes testing web forms and password protected areas easy
  • Support for pages with CAPTHCA, single sign-on and Two Factor authentication mechanisms
  • Extensive reporting facilities including VISA PCI compliance reports
  • Multi-threaded and lightning fast scanner crawls hundreds of thousands of pages with ease
  • Intelligent crawler detects web server type and application language
  • Acunetix crawls and analyzes websites including flash content, SOAP and AJAX
  • Port scans a web server and runs security checks against network services running on the server  
Brief Description of  Acunetix 8 Features:-

Manipulation of inputs from URLs:-
Acunetix WVS can automatically detect URL parameters and manipulate them to detect vulnerabilities. This technology is not present in any other competing vulnerability scanner.

Automatic IIS 7  rewrite rule interpretation:-

Using the web application’s web.config file, WVS 8 can automatically interpret rewrite rules without requiring any manual input.
Support for custom HTTP headers

To function correctly, some web applications need incoming requests to contain specific HTTP headers. It is now possible to define custom HTTP headers to be used during automated scans.

Imperva Web Application Firewall integration:-
An exciting co-operation between Imperva and Acunetix: WVS 8 scan results can be automatically imported into an Imperva Web Application Firewall and interpreted as rules.

New vulnerability class: HTTP Parameter Pollution:-

At the time of writing, Acunetix WVS 8 is the only scanner that tests for this security vulnerability.
Multiple instance support:-
Acunetix WVS 8 can be relaunched as multiple instances on the same machine, allowing the user to scan multiple websites and opening up further support for multi-user scenarios on the same server/workstation.
Redesigned Scheduler:-
Accessible via a web interface, the new Scheduler allows administrators to download scan results from any workstation, laptop, or smartphone. The new Scheduler will automatically launch another instance of WVS when multiple web scans are due, preventing multiple processes from depending on the resources of one WVS instance and thereby allowing scans to complete in less time.
Automatic custom 404 error page recognition and detection
Acunetix WVS 8 can automatically determine if a custom error page is in use and recognizes it without requiring any custom 404 recognition patterns to be configured for a scan

Scan settings templates:-

WVS 8 now allow the settings for the scan of a specific application to be saved as individual templates, making it quick and easy to recall the exact settings for a website each time it is scanned. This is particularly useful when scanning multiple sites, allowing the user to load the template for each site instead of re-configuring all the settings manually.

Simplified Scan Wizard:-
In addition to the introduction of Scan Settings Templates and automatic custom 404 error page recognition, the Scan Wizard contains far less options so it’s much easier and quicker to kick off a scan.
Smart memory management

The following settings have been added to ensure even the most complex scans will complete automatically, and successfully:-
  •     Define number of files per directory
  •     Limit number of subdirectories per website
  •     Assign Crawler memory limit

Real-time Crawler status:-

Crawler data is now updated in real-time information and provides live feedback how many files have been crawled, how many inputs have been detected, and more.

Scan termination status included in report:-

Reports now include the termination or completion status of each vulnerability scan. For example: the report will display if the scan was completed successfully or halted manually.

Web application coverage report:-
A new report template that lists all the web application files crawled and specific vulnerability tests performed on each file.
Log file retention:-
It is now possible to define the retention span before log files are automatically flushed; to ensure logs are not deleted each time WVS is restarted.


To Download Acunetix Web Vulnerability Scanner 8 BETA Click Here


SHARE OUR NEWS DIRECTLY ON SOCIAL NETWORKS:-

WikiLeaks Founder Julian Assange Extradited


WikiLeaks editor Julian Assange lost a court battle to stay in the United Kingdom Wednesday and will be extradited to Sweden to face questioning over sex charges, a court ruled. Appeals court judges Lord Justice John Thomas and Justice Duncan Ouseley rejected all four of the arguments Assange's defense team used to fight the extradition.
They will hold another hearing later this month to determine whether he can appeal.
"I have not been charged with any crime in any country," he said on the steps of the High Court in London. "Despite this, the European arrest warrant is so restrictive that it prevents UK courts from considering the facts of a case, as judges have made clear here today."
Assange is accused of sexually assaulting two women in Sweden in August 2010. Although he has not been charged with a crime, Swedish prosecutors want to question him in connection with the allegations.
The court comprehensively rejected his defense against being sent there to face prosecution, and was particularly scathing about a dispute with one of the women over whether she had consented to having sex with him.
Swedish authorities allege that the unnamed woman agreed to have sex with him only if he wore a condom, and that he then had unprotected sex with her while she was asleep.
"The allegation is that he had sexual intercourse with her when she was not in a position to consent and so he could not have had any reasonable belief that she did," the court said.
Assange drew cheers from the crowd as he left the court. A "Free Assange" rally was planned for Wednesday outside the Royal Courts of Justice.
Assange, an Australian, decided to fight the case at the High Court after a judge at Belmarsh Magistrates' Court ruled in February that the WikiLeaks head should be extradited.
Assange denies the accusations, saying they are an attempt to smear him, and he says it would be unfair to send him to a country where the language and legal system are alien to him. His attorneys have fought his extradition on procedural and human-rights grounds.
Assange's lawyers have suggested that Sweden would hand him over to the United States if Britain extradites him. The prosecutor representing Sweden has dismissed that claim.
The extradition case is not linked to his work as founder and editor-in-chief of WikiLeaks, which has put him on the wrong side of the U.S. authorities.
His organization, which facilitates the anonymous leaking of secret information, has published some 250,000 confidential U.S. diplomatic cables in the past year, causing embarrassment to the government and others.
It has also published hundreds of thousands of classified U.S. documents relating to the conflicts in Iraq and Afghanistan.
But the organization has come under increasing financial pressure in recent months, leading Assange to announce last week that WikiLeaks was temporarily stopping publication to "aggressively fundraise" in order to stay afloat.
A financial blockade by Bank of America, VISA, MasterCard, PayPal and Western Union has destroyed 95% of WikiLeaks' revenue, Assange said.
Many financial institutions stopped doing business with the site after it released the U.S. diplomatic cables late last year, and donations have been stymied.
U.S. authorities have said disclosing the classified information was illegal and caused risks to individuals and national security.


-News Source (CNN, BBC)


SHARE OUR NEWS DIRECTLY ON SOCIAL NETWORKS:-

Top 5 DDoS Attacks of 2011, Exclusive Report By Corero Network Security

Corero Network Security (cns:LN), the leader in on-premises Distributed Denial of Service (DDoS) Defense Systems for enterprises, data centers and hosting providers, named its list of 2011's Top 5 DDoS attacks. Corero's findings show an increase in newer, intelligent application-layer DDoS attacks that are extremely difficult to identify "in the cloud," and often go undetected until it is too late. Corero also found an uptick in attacks against corporations by "hactivists" DDoS-ing sites for political and ideological motives, rather than financial gain. Attacks against Mastercard, Visa, Sony, PayPal and the CIA top Corero's list.
"The cat-and-mouse game between IT administrators, criminals and hactivists has intensified in 2011 as the number of application-layer DDoS attacks has exploded. Coupled with an increase in political and ideological hactivism, companies have to be extremely diligent in identifying and combating attempts to disable their websites, steal proprietary information and to deface their web applications, " said Mike Paquette, chief strategy officer, Corero Network Security.

Corero's 2011 Top 5 DDoS Attacks:-

1. Anonymous DDoS Attacks on WikiLeaks "Censors" Visa, MasterCard and PayPal. The most significant DDoS attack so far this year, the WikiLeaks-related DDoS attacks on Visa, MasterCard and PayPal were both Anonymous' "coming out" party, and the first widespread example of what has been dubbed "cyber rioting" on the Internet, with virtual passersby joining in the attack voluntarily.

2. Sony PlayStation Network DDoS. A shocking wake-up call for many gamers, customers and investors, the Sony Playstation Network DDoS attack began a series of cyber attacks and data breaches that damaged Sony financially and hurt its reputation.

3. CIA and SOCA Hit by LulzSec DDoS Attacks. The appearance of LulzSec on the cyber attack scene, highlighted by bold DDoS attacks on the CIA and the U.K. Serious Organised Crime Agency (SOCA), made us wonder if anyone was safe on the Internet.

4. WordPress DDoS. A massive DDoS attack disrupted one of the world's largest blog hosts--some 18 million websites. The huge attack hit the company's data centers with tens of millions of packets per second.

5. Hong Kong Stock Exchange. This DDoS attack had a major impact on the financial world, disrupting stock market trading in Hong Kong. This was a highly leveraged DDoS attack, potentially affecting hundreds of companies and individuals through a single target.

For all the pain and suffering DDoS attacks have caused, there are a number of best practices that companies can implement to reduce their risk. The most effective defense against DDoS attacks requires expert preparation of defensive resources, ongoing vigilance and a rapid, organized response.

-News Source (Corero Network Security)


SHARE OUR NEWS DIRECTLY ON SOCIAL NETWORKS:-

Anonymous Planning to Attack The New York Stock Exchange (NYSE)


The FBI is investigating threats purportedly from the hacking collective that calls itself Anonymous to bring down the New York Stock Exchange on Monday by hacking into its computer system.
Members of the notorious hacker group appear to be threatening to bring the Occupy Wall Street protests in New York to a dangerous new level, sounding a call to “declare war on the New York Stock Exchange" on Monday by “erasing" it from the Internet.
FBI spokesman Tim Flannelly told that “The FBI is aware of these schemes and threats and is looking into the matter,” 
The hackers say they plan to launch a DDoS attack on the NYSE’s computer systems -- the same type of computer attack that brought down numerous websites last Spring, making them inaccessible.
Anonymous has also separately declared the Stock Exchange announcement a hoax, and it remains unclear whether this is an official effort by Anonymous, a group of rogue hackers or someone else entirely. Either way, the FBI is investigating.
“It is a crime to show the intent to carry out a hack when you are in possession of software or computer applications to do so and we take it seriously,” FBI spokesman Flannelly said.
In one of the videos, which was addressed to the media, a narrator states, “We can no longer stay silent as the population is being exploited and forced to make sacrifices in the name of profit. We will show the world that we are true to our word. On October 10, NYSE shall be erased from the Internet ... expect a day that will never, ever, be forgotten.” In a video addressed to the public, the narrator states, “We are the 99 percent. You have complained that something needs to be done. You now have an opportunity to make a difference. Join the protests. Organize your own. Watch online. Be a part of the movement.”


A digital flier has circulated online with the banner “Operation Invade Wall Street: This is not an occupation. This is an invasion,” and instructions how to participate in “three simple steps.”
It provides a link to download a program to participate as well as the URL for the Stock Exchange (www.nyse.com) and the date and time, October 10th at 3:30 p.m., to attack.
Would-be participants are also urged to “spread the F----- word.”
Still, other Anonymous representatives denied the plans.
A second letter has been posted online, also with Anonymous on the masthead, that references rumors of the planned attack and disclaims the group’s association:
“We have taken notice to a planned attack which has been named #InvadeWallStreet ...We strongly advise against this action and everything it entails to,” the letter says.
“We do not want history to repeat itself, and are sincerely worried,” the letter adds, referencing past attacks on Visa, Paypal, and Mastercard after they refused to accept transactions for payment to WikiLeaks.
Some have taken to Twitter, claiming the DDoS threat is a hoax, or even a setup.
“Smells like a trap! Don't participate,” said one tweet with the hashtag #invadewallstreet.
“HOAX: #invadewallstreet is not a valid OP. Beware of provocateurs!!!” said another posting.

-News Source (FOXNews)


SHARE OUR NEWS DIRECTLY ON SOCIAL NETWORKS:-

Leaked FBI Documents is Calling "Anonymous is A National Security Threat"


According to a PDF containing what purports to be a leaked psychological assessment of the leaders of LulzSec and Anonymous by the FBI's Behavioral Science Unit (which also profiles serial killers), Anonymous is not only not a collection of individuals, it's a coherent group that poses a threat to national security.
Neither the FBI nor Dept. of Homeland Security have commented on the "leak," which may be a fake according to the TechHerald, but seems to reflect accurately the thinking behind a series of DHS warning bulletins and crackdowns that have resulted in 75 raids and 16 arrests of Anonymous members just this year.
Anons themselves refer to the group as a rough, almost coincidental collective of individuals that occasionally cooperate on projects to protest specific things. There are approximately eight vortices of special interest within the collective, according to interviews, postings and counter-arguments posted by various Anonymi in response to invective by those it attacked.
Attacks are the work of small groups of interested individuals who, on their own initiative and using public argument as their weapon, gather like-minded Anonymi to protest governmental outrages or attack injustice in whatever form they find it, according to de facto leaders in the non-existent but vocal #OPpublicrelations.
In March, for example, members of Anonymous and 4Chan debated, in the finest traditions of American Democracy and citizen activism, whether to attack and defeat the Internet scourge that is Rebecca Black – the annoying but harmless pop "singer" whose made herself famous with a mom-and-dad-funded music video on YouTube that repeated the same lyrics so often it became apparent those might be the only words she knows.(Other, less world-shaking Anonymous projects resulted in significant attacks against the embattled governments of Egypt and Syria, the exposure of government atrocities in Bolivia, civil protest against censorship on the Bay Area Rapid Transit System, attacks on Visa, Mastercard and Paypal in support of whistleblower site WikiLeaks and a long-simmering, high-profile protest against unrestricted greed, corrosive dishonesty of Wall Street and the and economic destruction from which the rest of the country suffers while financiers continues to prosper.)
The FBI has analyzed various instant messages, forum postings, emails, Twitter posts and other documentation and decided Anonymous behaves more like a coherent organization led by a small number of powerful and focused activists, not a politically involved group of individuals using the Anonymous banner as gathering point.
  • "The Anonymous ‘collective’ has risen from an amorphous group of individuals on the Internet to the current state of a potential threat to national security. Due to the nature of Anonymous, they believe that they are a leaderless collective. However, it has been shown that there is a defined leadership group," the document reads.

  • "A thorough assessment of each UNSUB’s online activities, speech patterns, and general writings was collected by the FBI. Each UNSUB was individually assessed by members of the SBU (sic) and a psychological profile created from these datasets."

  • Most of the members of Anonymous are under 30, but the bulk of its leadership are not teenage hacker/script-kids as many portray themselves, according to the FBI.

  • "It is likely" that Sabu, one of the more vocal spokestrolls for the LulzSec mini-collective of Anonymous, "works in the information security sector and has been doing so since the early days of the internet and hacking activities. His use of net speak is interspersed with proper American English diction and grammar that implies he is an American citizen and has been educated,” the FBI notes said.

BS, quoth the Anon:

"Anonymous is not a group, it does not have leaders, people can do ANYTHING under the flag of their country," according to one member in an email interview with the AP. "Anything can be a threat to National Security, really," the member said in an email interview. "Any hacker group can be."
If the document is real, it ends on a disturbingly dangerous and presumptive conclusion: that attacks and protests by Anonymous will eventually lead to the death of members of Anonymous, law enforcement or the public that will drive many supporters away from Anonymous.
Until then, Anonymous, whether collectively or individually, may be unstoppable in practical terms.

The overall assessment for the movement however is the following:

1. The movement is out of control and there seems to be no real coherent motivation
2. The leaders have begun to hide themselves a bit more due to arrests that have been made
3. Their reliance on technology will eventually be their downfall
4. Their interpersonal relationships are weak points, as such they should be leveraged
5. Their increasing attacks on infrastructure will eventually lead to serious results that could in fact lead to deaths

-News Source (IT World)


SHARE OUR NEWS DIRECTLY ON SOCIAL NETWORKS:-

Wikileaks Is Now Exposing Bollywood

WikiLeaks is a non-profit media organization dedicated to bringing important news and information to the public who used to expose the governments across the globe. This time wikileaks is on Bollywood industry. Many of the cables are surprisingly succinct and contain detailed analysis of the Indian film industry that churns out almost 1000 films a year and generates billions of rupees in revenue. The documents look at different aspects of Bollywood, including its profitability, connections to organized crime, growth opportunities, and the Bollywood-Hollywood partnerships. India's movie industry generated an estimated Rs 10,700 crore in revenue in 2008, and that is expected to increase by an average of 11.5 per cent a year to 2013, Price water house Coopers said in a study.

  • Hollywood-Bollywood Partnerships:-

Two documents that analysed the Hollywood-Bollywood partnership are critical of the Hindi film industry and the scope of US film studios in the second fastest growing economy. "Hollywood film studios, amongst the world's highest revenue earners, are increasingly beginning to stake their claim in Bollywood," a document said. "Though not without challenges, major US studios have started to try to capture a piece of this potentially lucrative market. US studios ranging from Sony, Disney, and Warner Brothers have co-produced Hindi movies attracted by the growth potential and opportunities in Indian cinema," it said.
The embassy cable said while big budget Hollywood action films - dubbed in vernacular languages - have done relatively well in India, success has eluded Hollywood-Bollywood co-production partnerships so far.

  • Black Money:-

A leaked diplomatic cable also said that Bollywood welcomed funding from gangsters and politicians, known in India as "black money." While there is no direct reference of Dawood Ibrahim which allegedly financed a number of movies, the cable said that in recent decades, Bollywood has been associated with the notorious Mumbai underworld, at the nexus of gangsters, money, and politics.
According to Jehil Thakkar, Head of Media and Entertainment for (KPMG), this association stemmed from the financing needs of the industry; until 2000, by government fiat, the film industry was ineligible for bank credit, private equity, and other means of legitimate commercial financing.

  • Bollywood & US Visa:-

Following intensive investigation which also included a visit to the shooting site of 'My Name is Khan' the US Consulate in Mumbai in 2009 concluded that Bollywood generally does not misuse the US visas issued to its crew. Home to one of the largest entertainment industries in the world, Mumbai sends many stars and production crews to the US on O1 and O2 visas, it said, adding that the investigation was based on reports of fraud in other categories of visas.
"The study found that O2 travelers have a low overstay rate of 1.6 per cent. Site visits to major Indian production houses and no evidence of fraud for O2 applicants further suggests that most entertainment companies in Mumbai do not intend to misuse their US visas," said the US Consulate in Mumbai its cable dated December 14, 2009, which was released by WikiLeaks on August 30. 


-News Source (Wikileaks & IBN)

SHARE OUR NEWS DIRECTLY ON SOCIAL NETWORKS:-

LulzSec Spokesman Busted By Scotland Yard


Scotland Yard's cybercrime unit has arrested a teenager it suspects of working as the spokesman for the Lulz Security hacking collective, officials said Wednesday.
The Metropolitan Police's Central e-Crime Unit arrested a 18-year-old at an address in Scotland's remote Shetland Islands, the force said in a statement. His name wasn't released, but police said he was believed to be "Topiary," one of LulzSec's most prominent members.
Police originally gave his age as 19 but later issued a correction. 
LulzSec shot to prominence in May with attacks on the US Public Broadcasting Service - whose website it defaced by posting a bogus story claiming that the late rapper Tupac Shakur had been discovered alive in New Zealand.
The group is a spin-off of Anonymous, an amorphous collection of Internet enthusiasts, pranksters and activists whose targets have included the Church of Scientology, the music industry, and financial companies including Visa and MasterCard.
Topiary was linked to both groups, serving as the on-again, off-again media liaison for the publicity-hungry hackers.
In his only known television interview, on the "David Pakman Show" earlier this year, Topiary phoned in via Skype to feud with Shirley Phelps-Roper of the Westboro Baptist Church, a Kansas-based group notorious for picketing the funerals of slain American soldiers.
Anonymous vandalised the church's website live over the course of the interview.
In conversations with The Associated Press, Topiary said he controlled LulzSec's Twitter feed, which garnered some 300,000 followers over the course of its six-week-long Internet rampage.
LulzSec has claimed responsibility for breaches at pornography websites, gaming companies, and law enforcement organisations. It's also claimed credit for harassing seemingly random targets including an obscure New Jersey-based magnet manufacturer.
One its most spectacular hacks was against Sony Pictures Entertainment. The group posted the usernames, passwords, email addresses and phone numbers of tens of thousands of people, many of whom had given Sony their information for sweepstakes draws. Another stinging series of breaches last month targeted Arizona's police force in protest against its contentious immigration law. Officers had to scramble to change their numbers because their phones were being jammed with calls.
Shortly thereafter the group abruptly announced it was disbanding, although Topiary said at the time that the group wasn't bowing to police pressure.
"We're not quitting because we're afraid of law enforcement," he said in a Skype call. "The press are getting bored of us, and we're getting bored of us."
Attempts to reach Topiary since then have been unsuccessful, although his group recently re-emerged from retirement, defacing The Sun newspaper's website with a fake story claiming that media tycoon Rupert Murdoch had died. In one of its last messages, LulzSec said it was working with unnamed media outlets on a WikiLeaks-style release of emails it claimed to have stolen from the tabloid.
Topiary's once-plentiful Twitter feed was practically wiped clean Wednesday. The only remaining post, from nearly a week ago, read: "You cannot arrest an idea."
The latest arrest is one of an increasing number claimed by law enforcement in Britain and the United States in connection to their investigations into Anonymous and its offshoots. Last week, the FBI, British and Dutch officials carried out 21 arrests, many of them related to the group's attacks on Internet payment provider PayPal Inc., which has been targeted over its refusal to process donations to WikiLeaks.
Last month another 19-year-old, Ryan Cleary, was charged with attacks on Britain's Serious Organized Crime Agency and various UK-based music sites. Although at least one of the attacks he was charged with seemed linked to LulzSec, Topiary claimed at the time that Cleary was at most only tangentially involved with the group.
Scotland Yard said Wednesday it was also searching a residential address in Lincolnshire, in central England, and interviewing an unnamed 17-year-old in connection with the investigation. The second teen has not been arrested.

-News Source (IBN)

SHARE OUR NEWS DIRECTLY ON SOCIAL NETWORKS:-

Anonymous & Lulzsec Declared #OpPayPal (Antisec)

Anonymous and LulzSec's PayPal boycott campaign gathers momentum. Following the arrests of members in connection with an attack on PayPal's Web site, hacktivist groups Anonymous and LulzSec have launched an online campaign calling for people to close their accounts with the e-payments firm.
Earlier this month the FBI arrested 14 people accused of involvement in last year's cyber-attack on PayPal's Web site by Anonymous in retaliation for the company's closure of a donation account for Wikileaks.
Anonymous has teamed with LulzSec under the #AntiSec banner to issue a joint statement, declaring themselves "outraged at the FBI's willingness to arrest and threaten those who are involved in ethical, modern cyber operations".
In a change of tack, the partners are now calling for a legal form of protest, saying "we encourage anyone using PayPal to immediately close their accounts and consider an alternative" and asking people to tweet pictures of their actions.
The call to arms appears to have gathered some momentum, with the #OpPayPal hashtag the number three trending topic worldwide by 12.00 GMT, prompting @AnonymousIRC to tweet
 
"We hoped for a little impact, but honestly did not expect this. Waiting for NASDAQ to open. Our tip: SELL EBAY! WikiWiki! #AntiSec #OpPayPal"





In a tweet posted late afternoon, Wikileaks says it intends to file suit against eBay and Paypal in the US and Europe in line with its ongoing legal and anti-trust actions against Visa and MasterCard.
Separately, Anonymous' Austrian branch has accessed the bank data of 96,000 people in an attack on the GIS television licence agency's Web site, according to AFP.
To See the official press release of Anon & Lulzsec click here
To join the Official IRC of #opPayPal Click Here

SHARE OUR NEWS DIRECTLY ON SOCIAL NETWORKS:-

Related Posts Plugin for WordPress, Blogger...