Showing posts sorted by date for query leak. Sort by relevance Show all posts
Showing posts sorted by date for query leak. Sort by relevance Show all posts

Security Breach Invaded 8,500 Recipients of Unemployment Insurance Agency Michigan (UIA)

Posted by Avik Sarkar On 12/13/2013 01:22:00 am

Michigan Unemployment Insurance Agency (UIA) Hacked! 8,500 Recipients Personal Data Leaked
A major security breach has invaded Unemployment Insurance Agency of Michigan, widely known as UIA. Sources revealed that the attack was placed in between mid of July to mid of September which affected more than 8,500 unemployment insurance recipients in Michigan with leak of social security numbers, bank account numbers, passwords, phone numbers & few other sensitive data. This security breach was first detected Sept. 17 by contractor JP Morgan Chase. In his reaction the director of the Unemployment Insurance Agency, Shaun Thomas said -“The UIA is deeply concerned about this incident.” But due to some untold reason state official were not notified until this December first week. Dan Lohrmann, the state’s chief security officer in the Department of Technology, Management and Budget, said he has “worked closely with JP Morgan Chase to share our concern about the delayed notification and to ensure that the state receives immediate notice of future problems. “We work around the clock to keep citizen information and data protected, and I feel confident that everyone involved in this event understands the importance of protecting personal information.” Chase, which handles the debit cards Michigan uses to pay unemployment insurance benefits to some recipients, said those who accessed the bank’s website between mid-July and mid-September may have been affected. The 8,500 claimants in Michigan are among about 465,000 cardholders nationwide who may have been affected, the bank said. So far the identity of the hackers & their reasons behind this attack is not been identified, but Chase has notified law enforcement and both the bank and the state will be notifying claimants whose information was potentially compromised. 



SHARE OUR NEWS DIRECTLY ON SOCIAL NETWORKS:-

WikiLeaks Uncovered Secret Trans Pacific Partnership Agreement (TPP), Incoming Threat For Internet

Posted by Avik Sarkar On 11/19/2013 06:51:00 pm

WikiLeaks Uncovered Secret Trans Pacific Partnership Agreement (TPP), Incoming Threat For Internet 
After SOPA, PIPA & ACTA now the Internet is about to face another ferocious challenge named Trans-Pacific Partnership Agreement (TPP). I am sure that many of you are unaware of this TPP, as it is still on process, but WikiLeaks have uncovered ad released secret negotiated draft text for the entire TPP (Trans-Pacific Partnership) which is a multilateral free-trade treaty currently being negotiated in secret by 12 Pacific Rim nations. The current TPP negotiation member states are the United States, Japan, Mexico, Canada, Australia, Malaysia, Chile, Singapore, Peru, Vietnam, New Zealand and Brunei. "This Trans Pacific “Partnership” is really, really bad News. #WikiLeaks" -said the twitter feed of WikiLeaks. From the leaked draft we came to know that  TPP will take time for all the corporate rigging in this lengthy document to be understood, but already it is evident that Internet freedom will be curtailed, access to health care will become more expensive and access to information will be undermined. In short the more you know about the odious Trans-Pacific Partnership, the less you’ll like it. It’s made for corporate intellectual property and profits. According to WikiLeaks official website -"The TPP is the largest-ever economic treaty, encompassing nations representing more than 40 per cent of the world’s GDP. The WikiLeaks release of the text comes ahead of the decisive TPP Chief Negotiators summit in Salt Lake City, Utah, on 19-24 November 2013. The chapter published by WikiLeaks is perhaps the most controversial chapter of the TPP due to its wide-ranging effects on medicines, publishers, internet services, civil liberties and biological patents. Significantly, the released text includes the negotiation positions and disagreements between all 12 prospective member states." 

In the words of WikiLeaks’ Editor-in-Chief Julian Assange, “If instituted, the TPP’s IP regime would trample over individual rights and free expression, as well as ride roughshod over the intellectual and creative commons. If you read, write, publish, think, listen, dance, sing or invent; if you farm or consume food; if you’re ill now or might one day be ill, the TPP has you in its crosshairs.” To download the entire TPP (Trans-Pacific Partnership) draft click here. 

While talking about Jullian Assange and WikiLeaks, and this sensational leak of TPP, I would like to give you reminder that in this year we got several leaks from WikiLeaks, among them -'Detainee Policies' containing more than 100 classified or otherwise restricted files from the United States Department of Defense covering the rules and procedures for detainees in U.S. military custody. SpyFiles, GI Files (Global Intelligence Files & Five Million E-mails From Stratfor) & The Syria Files Containing 2.5 Million Emails of Syrian Politicians, Govt, Ministries & Companies. 



SHARE OUR NEWS DIRECTLY ON SOCIAL NETWORKS:-

Customs Services of Ukraine Govt Hacked By Anonymous, 1 GB of Classified Data Stolen

Posted by Avik Sarkar On 11/18/2013 08:16:00 pm

Customs Services of Ukraine Government Hacked By Anonymous, 1 GB of Classified Data Stolen
Anonymous -the world largest hacker community, also known as the infamous hacktivist who is widely known for engaging massive cyber attack against several governments strikes again. This time the target was Ukraine Government. According to multiple relevant sources of Anonymous it has been confirmed that the hackers have launched what it called an organised attack against different servers belongs to Ukrainian Government. During this round of cyber attack the main target was the Customs department of Ukraine. In their press release Anonymous took responsibility of performing onerous attack on CUSTOMS.GOV.UA, and caused what it called a voluminous data leak from it. This is the server that is responsible for the Odessa customs and handling of goods in the region of the Danube and Black Sea. From the press release we came to know that voluble of the stolen data is almost of 1GB, which is pointing a finger of sensational information of illegal operations of oil and gas, corruption schemes, bribes, cargo operations and so on. 
Most of the information is reported on the site, concerning the former head of the State Customs Service of Ukraine Ihor Kaletnik , who left the post after being elected deputy to in 2012 by Communist Party of Ukraine. Now Kaletnyk is the Deputy Speaker

Official Release of Anonymous: -

"Ukraine GOV hacked. CUSTOMS of UKRAINE customs.gov.ua MASSIVE Docs leak.
+ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + 
Greetings Our Fellow lulz. + 
+ 
Time to anchore Our ​​Marie Lulzize in an unstable Harbour + of Odessa in Ukraine. This Great Day We present you 1GB of raw + Data from one of the Servers of CUSTOMS.GOV.UA. To be pricise Ukraine Customs in + Black Sea and Danube - marine Customs. + Inside you Will Find lulz much related to Illegal Operations with + Oil and gas, corruption and Schemes Also much of good eddible Intel + All related to corruption in Ukraine Government controlled marine + Cargo Operations, Bribes and kickbacks gov. + Much of the Inside of the package is related to Ukraine + Former Chief Customs - Ihor Kaletnyk WHO is an active FSB operative + Russian enforcing rules of Engagement in Ukraine. + Also alot of Offshore moneylaundering by this persona and Other Government + Crooks. We undrstand that oil is money and money is power. + But They just do not Realize That one Day + shit happens and this shit pours from Big A Greedy right into Their throats.  + Sneak Peak of 64 Documents ..."

The hacker community has posted all the leaked information on an image archive and made that available for public. The 1 GB of the stolen data has also been made public in three different archive links. 

But on other hand the Ukrainian Government Officials denied the entire issue, according to the spokes man of government "Custom server can not be compromised. Therefore, as at customs.gov.ua a web server. Other documents, as far as I know, this server is not stored."  He also said that "Those documents that have posted allegedly crackers were not extracted from the server to the customs. In this I am 100%. Let me explain. Please note, most of the documents photographed, that is, it is done the person who had physical access to them, perhaps even temporary. Given that the documents from different regions of Ukraine, then they could meet only in the State Customs Service (MinDohodov) or law-enforcement agencies." 

While talking about this recent breach, we would like to remind you that couple of years ago, another infamous hacker community going by the name of Kosovo Hackers Security (KHS) targeted Ukraine govt. That time KHS have successfully penetrated the official website of Ukraine Police, Gazeta.ua (Ukraine Largest News Portal) and many more high profile sites. Now this hack of Anonymous is again another big attack which caused a serious damage to the Ukrainian cyber space. For updates on this hack and also all the other cyber updates stay tuned with VOGH. 




SHARE OUR NEWS DIRECTLY ON SOCIAL NETWORKS:-

VOGH Exclusive: Xbox Live Outage Caused For Networking Misconfiguration, Not Hacker Attack

Posted by Avik Sarkar On 4/18/2013 06:08:00 pm

Microsoft Said Xbox Live Outage Caused For Networking Misconfiguration During Routine Maintenance, Not Hacker Attack 

Xbox Live -one of the world's most popular and usually very reliable gaming network which rarely has unexpected outages, nor does Microsoft ever take it down for any extended period of time. But accident occurs, and it happened in last Sunday. The software giant and the developer of Xbox - Microsoft has reported a significant Xbox Live outage, rendering the service unavailable since earlier last 13th afternoon, smack in the middle of the peak weekend usage period. The outage is preventing users from signing in to Xbox Live, blocking access to the online services normally available through the console. While acknowledging the issue, on their official Xbox Live Status page Microsoft said “There is still an issue members are having signing in to Xbox LIVE, we greatly appreciate you sticking it out with us while we work as hard as we can to get this problem fixed. Keep checking back here every 30 minutes for another update on our progress.” This update came from Microsoft at 3:30 Pacific time on 13th of April. As soon as this story get spotted, several hikes rises. Among this buzz, it was a few unnamed hacker who took credit of the Xbox outage, while declaring that a cyber attack. Another buzz which just got spread so quickly, was that the outage of Xbox Live network has been caused by hacker collective Anonymous.  Here we must have to say that those buzz have some solid reasons as couple of months ago Windows Azure faced an organized cyber attack which effected the service of Azure storage, Xbox Live and 52 other. And that outage or in other word service interruption stays for 12 long hours. But unlike earlier, this time the issue get resolved immediately. Within one hour all the service get restored and came back to its normal order. On the same Xbox Live Status page Microsoft said “If you were one of the members who was having issues signing in to Xbox LIVE, good news! This issue has been fixed! Thank you so much for your patience during this time, feel free to go enjoy your favorite games and content!”
So far we have discussed about the story of the outage and it's restoration. Now we will talk about the cause of this interruption. As I have said earlier that the rumor of hacker's attack was there which was claiming responsibility of the Xbox Live outage. But in reality it was not due to cyber attack but some internal network problems. In their official respond of the situation and those buzz Microsoft completely dines all those rumors and said  "The Xbox Live service outage on 13 April resulted from networking misconfiguration during routine maintenance and was in no way related to false claims of hacking the service." 
While talking about Xbox outage, we would like to remind you that - another world famous gaming console 'PlayStation' had fallen victim to cyber attacks. It was Anonymous who hit Sony PSN and caused massive outage, data leak and many other devastating damages. 







SHARE OUR NEWS DIRECTLY ON SOCIAL NETWORKS:-

#OpIsrael Continues: KHS & MLA Hacked Several Israeli Govt Websites & Leaked Sensitive Data

Posted by Avik Sarkar On 4/07/2013 05:20:00 pm

Muslim Liberation Army (MLA) & Kosova Hacker Security (KHS) Joins Operation Isreal & Hacked Several Israeli Govt Websites & Leaked Sensitive Data

Operation Israel the devastating hacking rampage continues and becoming more and more venturesome for the Israeli cyber space. In the last week of March, it was dangerous hacker collective group Anonymous who called the operation also dubbed #OpIsrael, where the hacker group vows to erase Israel from the Internet. And as expected this is happening, the first quake came from Turkey-based Marxist hacker group named RedHack and Anonymous, where they targeted Israeli intelligence agency Mossad and breached personal data of 35K officials. Operation Israel, was not among those typical rampage of Anonymous, here Anon called other hackers from different part of of the spectrum to join. First it was RedHack who responded, and now the Muslim Liberation Army lead by Pakistani hacker Hitcher, along with Kosova Hacker's Security & few other Albanian hacker's community joined #OpIsrael. 
Yesterday it was Hitcher from Muslim Liberation Army (MLA) who targeted Israel’s Ministry of National Infrastructures (MNI). The hacker managed to breach the server of Israel Ministry and defaced several website belongs to Israel Ministry of Infrastructures. The attack took place at yesterday late night, but still at the time of writing the news, several Israel MNI websites are not performing. Not only MNI, as per sources several other high profile and Israeli government sites have also been taken down in this round attack. While covering this hack of Hitcher, we must have to recap the previous hack of  Pakistan hackers who are constantly against Israel (for Gaza issue) causing massive cyber attack against leading IT industry of Israel and other high profile Israeli sites. Just a couple of months ago, the world seen what it call the black day in the history if Israeli cyber space where another Pak hackers community hacked the main domain controller of Israel, which causes a massive hack against almost all the big Israeli sites such as government, MSN, Bing, Live, Skype, Microsoft Store, BBC, CNN, Coca-Colla, XBOX, Windows, Intel & many more. 


During the hacking rampage, Hitcher delivered the following message - 
“We are outraged at the Palestine present condition and the Illegal occupation of Palestinian Land By the Zionist Israelis. This attack is in response to the Injustice against the Palestinian people. Occupied Palestinian land under the guise of residential settlements are being increased. Palestinians are deprived of their basic human rights. International Aid workers are stopped from providing any humanitarian assistance to the people. The International community and media is not allowed to bring facts to world as due to strict restrictions” 

On the other hand, Kosova Hacker's Security along with few other Albanian hacker's community performed, what it called a demolishing cyber attack, that caused huge damage to the Israeli cyber space. During the attack Kosova Hacker's Security also known as KHS hit several important Israeli government & commercial websites such as  Civil Aviation Authority, Israel Police, Ministry of Health and many more. KHS caused damage to those websites, not by doing defacement by causing data leak. KHS hacked and exposed thousands of sensitive data, including full name, email-id, passwords and other confidential information of those said Israeli websites. All those leaked data have been made available by the hackers in a website called pentagoncrew.com All those hacks have been performed under the banner of Operation Israel also dubbed #OpIsrael for the cause of Gaza. For instance, here we can recap the hack of Kosova Hackers Security (KHS) where they hacked and exposed personal data of 35,000 Israeli people. 

At conclusion, we want to say that, at the time when Anonymous first called Operation Israel, Israeli government presumed that they have taken the threat very seriously and from the government end it has been  stated that they will take almost every steps to avoid any kind of disaster. Now after observing the above scenario it is clear that Israel Government have completely failed to protect their cyber space, in spite of having precaution. Also another thing get spot light, that is different hackers community have already came under a single shade in order to hit Israel against Gaza & Palestine issue. Today is the historical 7th April, I mean the day which Anonymous promised to erase Israel from the Internet. So the clock is running, lets see what more is about to come.  for the time stay tuned with VOGH to get all the latest update on this story and also other cyber issues. 







SHARE OUR NEWS DIRECTLY ON SOCIAL NETWORKS:-

Anonymous & RedHack Breached Israeli Intelligence Agency 'Mossad' Leaked Personal Data of 35K Officials

Posted by Avik Sarkar On 3/30/2013 02:18:00 am

Anonymous & RedHack Breached Israeli Intelligence Agency 'Mossad' Claimed to Have Personal Data of 35K Officials (#OpIsrael)

A week ago infamous hacker collective group Anonymous called for Operation Israel (#OpIsrael) second phase, where they vows to engage massive cyber attack against Israeli cyberspace in order to interrupt all the necessary service, which the hacker called a complete outage. The main phase of attack was planned at 7th April, but now it looks that those hacker collectives changed their strategy, or may be they can't wait till April, and as result anti-Israel hacking collective affiliated with Anonymous managed to breach several Israeli government servers, causing a big data leak of more than 35,000 Israeli government officials, including politicians, military leaders, and police officers. The hack was done under the banner of #OpIsrael, and from the twitter feed of Anonymous, the hacker group took responsibility of the cyber attack. A comprehensive spreadsheet purporting to include the information of all 35,000 Israeli officials was published by the website Cryptome, though it did not independently verify the information. The coalition of hackers appears to have ties to the Iranian government, Pakistan, Syria, Egypt, and the terror group Hezbollah, according to a report published by Cryptome. 
In our last report on this story we covered that, the attack will be organized as Anon ask other hackers and other underground communities to join the campaign. As expected, it happens; RedHack, a Turkey-based Marxist hacker group responded to Anonymous and they claimed to breach Israeli intelligence agency known as 'Mossad.' RedHack claimed to gain access inside Mossad's server; which lead them release personal information including phone numbers, emails and addresses of Mossad officials. "Yes, we realize we are sailing in dangerous water but we like swimming,” said hackers of RedHack. From a report of RT we came to know that not only data breach but also hackers performed massive denial of service attack against Mossad. In spite of RedHack’s claims, some argue that the names and information do not belong to Mossad officers or informants. 
“Whatever they stole, it probably wasn’t secure details of top Israeli brass, either from the army or the Mossad,” internet researcher Dr. Tal Pavel told the media. “There is no doubt that they got some identification information about Israelis, but the claims that they hacked the Mossad site and got a list of Mossad agents is most likely psychological warfare, and not a hack into an important database,” Pavel added. 
Whether those leaks are not that classified, whether those data does not belongs to Mossad, but one thing is clear and that is in-spite of having precaution, Israel government yet again failed to protect themselves from massive attack which caused a massacre. And from this story it is also predictable that hackers around the globe came under one shade or one unity, in order to target Israel over Gaza issue. As 7th April is still a week away from today so lets wait for the time, and stay tuned with VOGH to get all the latest update on this story and also other cyber issues.







SHARE OUR NEWS DIRECTLY ON SOCIAL NETWORKS:-

Ministry of Defense Argentina Hacked By LulzSec Peru, Sensitive Information (Aircraft, Submarines, Weapons) Leaked

Posted by Avik Sarkar On 1/05/2013 09:48:00 pm

Ministry of Defense Argentina Hacked By LulzSec Peru, Sensitive Information (Aircraft, Submarines, Weapons) Leaked

A hacktivist group claiming to be the part of infamous LulzSec, targeted the official website of Argentinian Ministry of Defense. This round of cyber attack taken sensitive data from Ministry of Defense server, along with that the index page also get defaced by the hacker group calling them selves 'LulzSec Peru'. The leaked data, allegedly said “top secret” documents from the ministry’s systems has been posted on AnonPaste. The total leak is almost 100 megabytes in size, contains information on submarines, radars and weapons. It also contains user details such as usernames, passwords, the names of officials and other sensitive information. The release on AnonPaste also did satire of the cyber security system of Argentinian Ministry while saying "According to statements by the DEPARTMENT OF ARGENTINA DEFENSE the computer systems area say they had a system impossible to hack, thing turned otherwise. The event should not be taken as terrorism, was for the simple fact to prove that the system was totally vulnerable. The documents contain highly sensitive material rated SECRET (aircraft, submarines, guns)..."
As per sources the data dump, leaked by the hacker was indeed stolen from Ministry's system, also the deface mirror on Zone-H is showing that the official website was indeed hacked and defaced. Though the officials of Argentinian Ministry did not commented about this incident. After the hack was spotted on the wild, the authorities restored their system, and the website came back to its normal format very soon. 




SHARE OUR NEWS DIRECTLY ON SOCIAL NETWORKS:-

Personal Data of 35,000 Israeli People Leaked By Kosovo Hackers Security (KHS)

Posted by Avik Sarkar On 11/19/2012 03:03:00 am

Personal Data of 35,000 Israeli People Leaked By Kosovo Hackers Security (KHS)

More hackers taking part in the Israeli rampage dubbed Operation Israel. As soon as the story of bombing and air strike in Gaza get spotted on the social networks, we have seen immediate protest coming from almost every part of the world. In case of digital bombing, then it was first Anonymous who called Operation Israel, then hackers from different part of the world joined and contributed in this combined protest. So far we have seen along with Anon, Pakistani hacker Hitcher from Muslim Liberation Army, Indian hacker Godzilla have played vital role in this rampage. According to sources more than 44 million hacking attempts have been made on Israeli government web sites since Wednesday. Attempts on defense related sites have been the highest, while 10 million attempts have been made on the site of Israel's president, 7 million on the Foreign Ministry and 3 million on the site of the prime minister.
But its yet not over, many more to come, as another very popular hacker collective group named Kosovo Hackers Security (KHS) have taken part in #OpIsrael. At the very first phase of their attack Kosovo Hacker's Security Group has attacked many servers belongs to Israeli govt, corporate & other major sectors. Thus the hacker group has gathered documents of more that 35,000 Israeli people including full name, email-id, postal address, phone number, passwords, fax & so on. According to KHS those leaked data belongs to Israeli citizen, along with Govt employs, police and several other sensitive personalities. All those leaked data are made public by the hacker group and can be found in 1337.al. KHS leader & Hotmail hacker, Th3 Dir3ctorY vows to engage more cyber attack against Israel while saying "Israel is attacking Gaza without any proper reason, so if they don't stop doing that we will attack in the energy sector & nuclear area of Israel and we will attack Israel with very bad viruses..." Before this leak, earlier in this year KHS also exposed more than 7 thousand credit card details of Israeli people. Also this hacker group was behind several attacks against Ukraine, Greece, Hotmail, IBM and so on.




SHARE OUR NEWS DIRECTLY ON SOCIAL NETWORKS:-

TOR Client Leaking Sensitive Information From Cache Memory, Later The Bug Has Been Fixed

Posted by Avik Sarkar On 11/10/2012 12:57:00 am

TOR Client Leaking Sensitive Information From Cache Memory, Later The Bug Has Been Fixed  

Major security issue has been found in the world's most famous and widely used software for online anonymity, Tor (The Onion Router). A software developer named Andrey Karpov found that the anonymisation software uses a function called memset() to delete cache data, which is not supported by all compilers. In some cases, that can cause the TOR client to leave confidential data like passwords in the system memory when it is closed. The memset() function is problematic because it is automatically deleted when TOR is optimized for speed with a compiler like the one in Microsoft Visual Studio 2010. Once that happens, the data remains in system memory, where it can be read by malicious programs.
As soon as this security issue get spot light The Tor Project has immediately issues a fix to close the security vulnerability which leads to leak information from memory on some machines running Tor that could give an attacker access to sensitive information stored in the cache. The developers at the Tor Project were alerted to the problem recently and began looking into the issue. What they found is that in some cases, when the Tor client uses a function called memset to erase some cache data on a machine, some of that information will still remain when Tor exits. The data that remains could give an attacker access to sensitive information in the cache. The strring explaining the bug fix in Tor says that different compilers handle the situation differently. In their bug fix Tor Project says that "Tor tries to wipe potentially sensitive data after using it, so that if some subsequent security failure exposes Tor's memory, the damage will be limited. But we had a bug where the compiler was eliminating these wipe operations when it decided that the memory was no longer visible to a (correctly running) program, hence defeating our attempt at defense in depth. We fix that by using OpenSSL's OPENSSL_cleanse() operation, which a compiler is unlikely to optimize away. Future versions of Tor may use a less ridiculously heavy approach for this. Fixes bug 7352."



 -Source (Tor Project, The-H & threatpost)

SHARE OUR NEWS DIRECTLY ON SOCIAL NETWORKS:-

VMware Confirmed: The Source Code of ESX kernel Was Indeed Stolen By Hackers

Posted by Avik Sarkar On 11/07/2012 04:12:00 am

VMware Confirmed: The Source Code of ESX kernel Was Indeed Stolen By Hackers

VMware, the global leader in virtualization and cloud infrastructure again faced cyber attack. Earlier in this year a hacker named "Hardcore Charlie" had stolen files from its ESX server hypervisor source code has been posted online. In that attack the hacker managed to steal more than 300MB source code of  VMWare products. Here also after 6 months another hacker named Stun (57UN) claiming to be affiliated with hacker collective Anonymous managed to hack the source code of VMware's ESX kernel. Immediately after the breach the hacker tweeted a link to a torrent site hosting the stolen VMkernel source code. In their official blog post VMware director of platform security Iain Mulholland acknowledged the breach on Sunday and confirmed the source code was indeed stolen. But VMware also confirmed that leaked is source code that dates back to 1998-2004 which was previously leaked Hardcore Charlie. VMware also said that it is investigating what actions to take next. The torrent file posted by 57UN is leading to download you the source code of VMware ESX, that is sized almost 2MB. 
In a security note VMware said- "our security team became aware of the public posting of VMware ESX source code dating back to 2004. This source code is related to the source code posted publicly on April 23, 2012. It is possible that more related files will be posted in the future. We take customer security seriously and have engaged our VMware Security Response Center to thoroughly investigate. Ensuring customer security is our top priority. As a matter of best practices with respect to security, VMware strongly encourages all customers to apply the latest product updates and security patches made available for their specific environment. We also recommend customers review our security hardening guides. By applying the combination of the most current product updates and the relevant security patches, we believe our customer environments will be best protected. As is our practice, VMware will continue to assess any further security risks, and will provide recommendations and updates here as appropriate..." VMware also encouraged its customers to view the May 3, 2012 security patch information as a resource.

While talking about source code leak, we want to remind you that couple of months ago this hacker (57UN) stolen the source code of Skype. Also earlier in 2012 another hacker group named  The Lords of Dharmaraja has managed to steal the source code of Norton Symantec. 





SHARE OUR NEWS DIRECTLY ON SOCIAL NETWORKS:-

"Project Blackstar" Team Ghostshell Leaks 2.5 Million Records From Russian Govt & Individual

Posted by Avik Sarkar On 11/05/2012 05:08:00 am

"Project Blackstar" Team Ghostshell Leaks 2.5 Million Records From Russian Govt & Individual 

A hacker group calling them selves "Team Ghostshell" who was recently behind the attack several top universities called an open operation declaring war on Russia's cyberspace. The operation is dubbed “Project Blackstar”. In the first phase of the operation  the hacking collective Team Ghostshell posted approximately 2.5 million accounts/records leaked, from governmental, educational, academical, political, law enforcement, telecom, research institutes, medical facilities, large corporations (both national and international branches) in such fields as energy, petroleum, banks, dealerships and many more. The hacker group also claimed to have access "to more russian files than the FSB and we are very much  eager to prove it." - said Ghostshell. The rest of the Pastebin post goes on to call out the Russian government and is littered with references to corruption, capitalism and social injustice. Judging by some of the records released, the Russian Police, along with Novatek, Russia's largest independent natural gas producer, the Alfa Group, an investment consortium and JINR, the country’s Joint Institute for Nuclear Research, all appear to have been implicated in the alleged leak. Some records appear to include individuals’ usernames and passwords while other documents almost read like resumes, complete with individuals’ names, IP addresses, education and job history.
Above I have discussed the last hack by Team Ghostshell where they had published 120,000 records from some of the world’s top universities. That leak, dubbed “Project WestWind,” sought to “raise awareness towards the changes made in today’s education,“ spilling student and faculty email addresses, passwords and IDs. Now this “Project Blackstar” with a leak of 2.5 million records from several Russian cyber space,  again arising a big doubt, that how much secure our cyber world is? 



SHARE OUR NEWS DIRECTLY ON SOCIAL NETWORKS:-

Unpatchable Security Hole in PlayStation 3 Leading The "final hack" Also LV0 Cryptographic Keys Revealed

Posted by Avik Sarkar On 10/26/2012 05:59:00 am

Unpatchable Security Hole in PlayStation 3 Leading The "final hack" Also LV0 Cryptographic Keys Revealed

We all are very much aware that Sony along with its product's were always been a very hot favorite target of hackers. But here there are few twists, so the word 'Hack' will be be the appropriate one to describe of what happened to Sony. According to a report on Eurogamer Sony's PlayStation 3 is facing a new security threat - one it hasn't seen since the system was cracked via the PSJailbreak in 2011. The PS3 has been hacked before, but Sony was able to inhibit the hack with an update to its own firmware. This is much like the history of jailbreaking on Apple's iOS. But the latest PS3 break is being dubbed unpatchable and the final hack. That's because this hack isn't giving you an exploit to use against a programming hole. It's giving you Sony's so-called LV0 (level zero) cryptographic keys. 
A decryption key that is reported to be circulating on the net is said to remove the final protective barrier on some models of Sony's PlayStation 3 consoles. In the long run, the release of the key will probably allow unsigned software such as homebrew games, Linux distributions, or pirate copies of software to run on some PS3 consoles. Allegedly, the private key can be used to modify and sign the "LV0" (Level 0), for example to disable its security checks. When the PS3 system boots, from version 3.60 of the PS3's firmware, the LV0 is directly launched by the bootloader (bootldr) that is built into the system's hardware – which means that the chain of trust is broken at a very early stage. As Sony won't be able to update the bootloader with a software update, the hacker community considers this the "final hack" of the PS3 in its current forms. Eurogamer says that these keys may not have been released at all if not for a Chinese hacking outfit called "BlueDiskCFW," who gained access to the keys and planned to charge for new custom firmware updates it would create. The original group that created the LV0 had no plans on releasing them, but eventually they were leaked onto the Internet in some limited fashion. Seeing that someone was going to profit on them, the group known as "The Three Tuskateers" decided to release them into the wilds of the Internet. 
In a statement the hacker group says that "You can be sure that if it wouldn't have been for this leak, this key would never have seen the light of day, only the fear of our work being used by others to make money out of it has forced us to release this now," 





SHARE OUR NEWS DIRECTLY ON SOCIAL NETWORKS:-

Whonix -Anonymous Operating System Based on Debian/GNU Linux & Tor

Posted by Avik Sarkar On 10/16/2012 07:34:00 pm

Whonix -Anonymous Operating System Based on Debian/GNU Linux & Tor 

Whonix, which is earlier called TorBOX or aos; now been reintroduced with a new style. This time we got a complete anonymous general purpose Operating System based on Virtual Box, Debian GNU/Linux and Tor.  According to the project wiki page - in Whonix IP and DNS leaks are impossible. Not even malware with root rights can find out the user's real IP/location. This is because Whonix consists of two virtual machines. One machine solely runs Tor and acts as a gateway, which we call Whonix-Gateway. The other machine, which we call Whonix-Workstation, is on a completely isolated network. Only connections through Tor are possible. 

We request our reader to See Security for a more comprehensive description, security features and threat model. You can even go through with full change log and also download the source code from github. 

Key Features:- 

  • Adobe Flash anonymously
  • browse the web anonymously
  • Anonymous IRC
  • Anonymous Publishing
  • Anonymous E-Mail with Mozilla Thunderbird and TorBirdy
  • Add a proxy behind Tor (Tor -> proxy)
  • Based on Debian GNU/Linux.
  • Based on the Tor anonymity network.
  • Based on Virtual Box.
  • Can torify almost any application.
  • Can torify any operating system
  • Can torify Windows.
  • Chat anonymously.
  • Circumvent Censorship.
  • DNSSEC over Tor
  • Encrypted DNS
  • Full IP/DNS protocol leak protection.
  • Hide the fact that you are using Tor/Whonix
  • Isolating Proxy
  • Java anonymously
  • Javascript anonymously
  • Location/IP hidden servers
  • Prevents anyone from learning your IP.
  • Prevents anyone from learning your physical location.
  • Private obfuscated bridges supported.
  • Protects your privacy.
  • Protocol-Leak-Protection and Fingerprinting-Protection
  • Secure And Distributed Time Synchronization Mechanism
  • Security by Isolation
  • Stream isolation to prevent identity correlation through circuit sharing
  • Virtual Machine Images
  • VPN/Tunnel Support
  • Whonix is produced independently from the Tor (r) anonymity software and carries no guarantee from  The Tor Project about quality, suitability or anything else.
  • Transparent Proxy
  • Tunnel Freenet through Tor
  • Tunnel i2p through Tor
  • Tunnel JonDonym through Tor
  • Tunnel Proxy through Tor
  • Tunnel Retroshare through Tor
  • Tunnel SSH through Tor
  • Tunnel UDP over Tor
  • Tunnel VPN through Tor
To Download Whonix-0.4.5 Click Here. Before download please note that Whonix is produced independently from the Tor anonymity software and carries no guarantee from The Tor Project about quality, suitability or anything else. 






SHARE OUR NEWS DIRECTLY ON SOCIAL NETWORKS:-

Nessus 5.0.2 Vulnerability Scanner Released & Available For Download

Posted by Avik Sarkar On 10/11/2012 03:51:00 am

Nessus 5.0.2 Vulnerability Scanner Released & Available For Download 

Earlier we have discussed several times about Nessus, a proprietary comprehensive vulnerability scanning tool. After almost six months, yet again Tenable Network Security officially announced the availability of Nessus 5.0.2. According to surveys done by sectools.org, Nessus is the world's most popular vulnerability scanner, taking first place in the 2000, 2003, and 2006 security tools survey. Tenable estimates that it is used by over 75,000 organizations worldwide. This update is largely a bugfix release, however a new build for Solaris 10 is now available. The major issues addressed in 5.0.2 include enhanced support for UTF8 encoding problems in reports and the detection of network congestion errors during scans more conservatively. 

Official Change Log for Nessus 5.0.2:- 
  • UTF8 encoding problems would sometimes cause the generation of reports to fail 
  • Fixed a case where generating some compliance checks reports would cause the scanner to hang, using 100% of the CPU 
  • Resolved a resource leak issue occurring when a large number of different users are connected at the same time 
  • Network congestion errors are now detected more conservatively 
  • Upgraded libxml2, libxslt, openssl to their newest versions 
  • Some nessusd.rules directives were not honored by the port scanners 
  • Solaris 10 build
Other fixes:-
  • Smarter max_hosts and global.max_hosts defaults
  • Added support for named virtual hosts for IPv6
  • Fixed a memory leak when mixing IPv4 and IPv6 targets
  • Fixed the systemd control script (Fedora 16)
  • Fixed a crash in nessus-mkcert on the command-line (Win32)
  • Fixed a crash in localtime(), when passed an invalid argument (Win32)
  • Fixed scratchpad_query() to allow NULL arguments
  • PSSDK fix (Win32)

To Download Nessus 5.0.2 Click Here



SHARE OUR NEWS DIRECTLY ON SOCIAL NETWORKS:-

PostgreSQL Patches Vulnerability in The built-in XML & XSLT (CVE-2012-3488,3489)

Posted by Avik Sarkar On 8/18/2012 10:08:00 am


PostgreSQL Patches Vulnerability in The built-in XML & XSLT (CVE-2012-3488,3489)
PostgreSQL Global Development Group released security updates for all active branches of the PostgreSQL database system, including versions 9.1.5, 9.0.9, 8.4.13 and 8.3.20. This update patches security holes associated with libxml2 and libxslt, similar to those affecting other open source projects. All users are urged to update their installations at the first available opportunity. This security release fixes a vulnerability in the built-in XML functionality, and a vulnerability in the XSLT functionality supplied by the optional XML2 extension. Both vulnerabilities allow reading of arbitrary files by any authenticated database user, and the XSLT vulnerability allows writing files as well. The fixes cause limited backwards compatibility issues. These issues correspond to the following two vulnerabilities:
This release also contains several fixes to version 9.1, and a smaller number of fixes to older versions, including:
  • Updates and corrections to time zone data
  • Multiple documentation updates and corrections
  • Add limit on max_wal_senders
  • Fix dependencies generated during ALTER TABLE ADD CONSTRAINT USING INDEX.
  • Correct behavior of unicode conversions for PL/Python
  • Fix WITH attached to a nested set operation (UNION/INTERSECT/EXCEPT).
  • Fix syslogger so that log_truncate_on_rotation works in the first rotation.
  • Only allow autovacuum to be auto-canceled by a directly blocked process.
  • Improve fsync request queue operation
  • Prevent corner-case core dump in rfree().
  • Fix Walsender so that it responds correctly to timeouts and deadlocks
  • Several PL/Perl fixes for encoding-related issues
  • Make selectivity operators use the correct collation
  • Prevent unsuitable slaves from being selected for synchronous replication
  • Make REASSIGN OWNED work on extensions as well
  • Fix race condition with ENUM comparisons
  • Make NOTIFY cope with out-of-disk-space
  • Fix memory leak in ARRAY subselect queries
  • Reduce data loss at replication failover
  • Fix behavior of subtransactions with Hot Standby
Users who are relying on the built-in XML functionality to validate external DTDs will need to implement a workaround, as this security patch disables that functionality. Users who are using xslt_process() to fetch documents or stylesheets from external URLs will no longer be able to do so. The PostgreSQL project regrets the need to disable both of these features in order to maintain our security standards. These security issues with XML are substantially similar to issues patched recently by the Webkit (CVE-2011-1774), XMLsec (CVE-2011-1425) and PHP5 (CVE-2012-0057) projects. As with other minor releases, users are not required to dump and reload their database or use 
pg_upgrade
In order to apply this update release; you may simply shut down PostgreSQL and update its binaries. Perform post-update steps after the database is restarted. All supported versions of PostgreSQL are affected. Or you can download the new versions now at the main download page.




SHARE OUR NEWS DIRECTLY ON SOCIAL NETWORKS:-

Related Posts Plugin for WordPress, Blogger...

Site search