XSS Vulnerability Found By Hitcher on the Official Website of Tom Cruise & Delhi Chamber Of Commerce


Pakistani Hacker Hitcher found non-persistent XSS Vulnerability on the Official Website of Famous Hollywood Actor Tom Cruise and also on the Delhi Chamber Of Commerce website.

Tom Crusie:-

Vulnerable Website:-
 

Vulnerable Link:-


 
Delhi Chamber Of Commerce:-

Vulnerable Website:-

Vulnerable Link:-

SHARE OUR NEWS DIRECTLY ON SOCIAL NETWORKS:-

Oracle Released a Mammoth 78 Patches


Oracle is to release a mammoth 78 patches on Tuesday as part of the company's quarterly security update, including 23 fixes for Sun products and 13 for Database Server.
Oracle said in a Critical Patch Release pre-release announcement on Thursday that the patches have been designed to fix flaws across hundreds of its products.
"Some of the vulnerabilities addressed in this Critical Patch Update affect multiple products," the firm said.
"Due to the threat posed by a successful attack, Oracle strongly recommends that customers apply Critical Patch Update fixes as soon as possible."
Two of the 13 vulnerabilities in Oracle Database Server could be exploited remotely and without authentication, as could three in Oracle Secure Backup, according to the firm.
Oracle is also planning 18 new security fixes for Oracle Enterprise Manager Grid Control, 12 for PeopleSoft products, seven for Oracle Fusion Middleware and one each for E-Business Suite and Supply Chain Products Suite.
However, the largest number of patches is reserved for the Oracle Sun Products Suite. Nine of these vulnerabilities could be remotely exploited "over a network without the need for a username and password", the firm warned.
This quarter's patch update will keep administrators busy, but only just trumps Oracle's April update, which addressed 73 vulnerabilities in 25 products, including the Oracle Database 11g, Fusion Middleware, Application Server and People Enterprise platforms.
To see the official Statement of Oracle Click HERE

SHARE OUR NEWS DIRECTLY ON SOCIAL NETWORKS:-

Finally Flash 11 beta 64-bit Support For Linux is Now Available

Adobe has released the first beta of Flash 11, a major update of the rich media browser plug-in. A significant change in this version of Flash is the availability of 64-bit builds for Windows, Linux, and Mac OS X.
The long-overdue delivery of 64-bit support is a major milestone for Adobe. The company first demonstrated an experimental 64-bit Flash plug-in prototype in 2008 and vowed to eventually deliver support for the x64 architecture across all of the major desktop operating systems. The plan had to take a backseat, however, as Adobe's focus shifted to other priorities. Improving Flash's performance and reliability on mobile devices has consumed much of the company's attention over the past year.
Adobe dropped its previous experimental 64-bit Flash plug-in roughly a year ago, citing the need for significant architectural changes. At the time, we joked that Flash's 64-bit support might finally land at about the same time as Duke Nukem Forever. It's sort of funny how that worked out. Unlike Duke's less-than-triumphant return, however, the new 64-bit Flash plugin actually lives up to its promise.
Linux users have typically had to rely on frameworks like nspluginwrapper to use the 32-bit Flash plug-in in a 64-bit browser. Due to native 64-bit support, the new beta version of the Flash plug-in can be used without a shim. We briefly tested it on Ubuntu 11.04 in the Firefox Web browser. In light of Adobe's controversial decision to discontinue Adobe AIR on the Linux platform, it's a bit surprising that it is treating the operating system as a first-class citizen with 64-bit support in Flash 11.

In addition to 64-bit support, the new plug-in also introduces the new Stage3D APIs—Adobe's Molehill project—which provides hardware-accelerated 3D rendering capabilities in the same vein as WebGL. The runtime has also gained improved JSON handling and some technical improvements that make garbage collection less intrusive. Another nice addition is support for H.264 encoding of real-time video streams captured from the user's camera—offering better compression for video chat and other similar kinds of applications.
The plug-in is available for download from Adobe's website in 32-bit and 64-bit flavors. Adobe warns, however, that the beta is still a work in progress and not intended for serious day-to-day use. I didn't encounter any serious problems during my brief test of the plugin.
To see the official Announcement of Adobe Click Here 


-News Source (ARS & Adobe)

SHARE OUR NEWS DIRECTLY ON SOCIAL NETWORKS:-

songs.pk Hacked By Indishell (Protest Against Recent Mumbai Massacre)


Famous and Biggest Bollywood songs Downloading site songs.pk has been hacked by "Team Indishell/Indian Cyber Army" in the return of the Mumbai recent massacre. 

Hacked Site:-


Mirror Link:-


Message Given By Indishell:-

"...Pray for all the innocent victims of Mumbai attack ..
This is a small answer from All Indians.. Remember we are Together..
You can just kill innocent people .. Women & Children..
But There is no Future for you.. We are coming with huge speed..
Corruption will be under control.. Every Indian will have Money n Power..
Then there will be no one to Save you..
You are dirty stamp on Pure Islam.. Try to Understand & Respect it..
Just Remember We are coming..."

SHARE OUR NEWS DIRECTLY ON SOCIAL NETWORKS:-

The First Cyberspace Strategy By U.S. Defense


Cyberspace is a defining feature of modern life. Individuals and communities worldwide connect, socialize, and organize themselves in and through cyberspace. From 2000 to 2010, global Internet usage increased from 360 million to over 2 billion people. As Internet usage continues to expand, cyberspace will become increasingly woven into the fabric of everyday life across the globe. 
U.S. and international businesses trade goods and services in cyberspace, moving assets across the globe in seconds. In addition to facilitating trade in other sectors, cyberspace is itself a key sector of the global economy. Cyberspace has become an incubator for new forms of entrepreneurship, advances in technology, the spread of free speech, and new social networks that drive our economy and reflect our principles. The security and effective operation of U.S. critical infrastructure – including energy, banking and finance, transportation, communication, and the Defense Industrial Base – rely on cyberspace, industrial control systems, and information technology that may be vulnerable to disruption or exploitation. 
Along with the rest of the U.S. government, the Department of Defense (DoD) depends on cyberspace to function. It is difficult to overstate this reliance; DoD operates over 15,000 networks and seven million computing devices across hundreds of installations in dozens of countries around the globe. DoD uses cyberspace to enable its military, intelligence, and business operations, including the movement of personnel and material and the command and control of the full spectrum of military operations. 
The Department and the nation have vulnerabilities in cyberspace. Our reliance on cyberspace stands in stark contrast to the inadequacy of our cybersecurity – the security of the technologies that we use each day. Moreover, the continuing growth of networked systems, devices, and platforms means that cyberspace is embedded into an increasing number of capabilities upon which DoD relies to complete its mission. Today, many foreign nations are working to exploit DoD unclassified and classified networks, and some foreign intelligence organizations have already acquired the capacity to disrupt elements of DoD’s information infrastructure. 
Moreover, non-state actors increasingly threaten to penetrate and disrupt DoD networks and systems. We recognize that there may be malicious activities on DoD networks and systems that we have not yet detected. 

DoD, working with its interagency and international partners, seeks to mitigate the risks posed to U.S. and allied cyberspace capabilities, while protecting and respecting the principles of privacy and civil liberties, free expression, and innovation that have made cyberspace an integral part of U.S. prosperity and security. How the Department leverages the opportunities of cyberspace, while managing inherent uncertainties and reducing vulnerabilities, will significantly impact U.S. defensive readiness and national security for years to come. 

DOD’S STRENGTHS AND OPPORTUNITIES IN CYBERSPACE:-

As does the nation as a whole, DoD relies on a secure and reliable cyberspace that protects fundamental freedoms, privacy, and the free flow of information. In support of both U.S. core commitments and national security, DoD has significant strengths and opportunities in cyberspace. The U.S. military’s ability to use cyberspace for rapid communication and information sharing in support of operations is a critical enabler of DoD missions. More broadly, DoD’s depth of knowledge in the global information and communications technology sector, including its cybersecurity expertise, provides the Department with strategic advantages in cyberspace. 
The quality of the United States’ human capital and knowledge base in both the public and private sectors provides DoD with a strong foundation on which to build current and future cyber capabilities. DoD has played a crucial role in building and leveraging the technological prowess of the U.S. private sector through investments in people, research, and technology. DoD will continue to embrace this spirit of entrepreneurship and work in partnership with these communities and institutions to succeed in its future cyberspace activities. 
Given the dynamism of cyberspace, nations must work together to defend their common interests and promote security. DoD’s relationship with U.S. allies and international partners provides a strong foundation upon which to further U.S. international cyberspace cooperation. Continued international engagement, collective self-defense, and the establishment of international cyberspace norms will also serve to strengthen cyberspace for the benefit of all. 

CYBER THREATS:-

The Internet was designed to be collaborative, rapidly expandable, and easily adaptable to technological innovation. Information flow took precedence over content integrity; identity authentication was less important than connectivity. The Internet’s original designers could not have imagined the extent of its vital and growing role for DoD and its operations. The global scope of DoD networks and systems presents adversaries with broad opportunities for exploitation and attack. 
Low barriers to entry for malicious cyber activity, including the widespread availability of hacking tools, mean that an individual or small group of determined cyber actors can potentially cause significant damage to both DoD and U.S. national and economic security. Small-scale technologies can have an impact disproportionate to their size; potential adversaries do not have to build expensive weapons systems to pose a significant threat to U.S. national security.
In developing its strategy for operating in cyberspace, DoD is focused on a number of central aspects of the cyber threat; these include external threat actors, insider threats, supply chain vulnerabilities, and threats to DoD‘s operational ability. DoD must address vulnerabilities and the concerted efforts of both state and non-state actors to gain unauthorized access to its networks and systems. 
Foreign cyberspace operations against U.S. public and private sector systems are increasing in number and sophistication. DoD networks are probed millions of times every day, and successful penetrations have led to the loss of thousands of files from U.S. networks and those of U.S. allies and industry partners. Moreover, this threat continues to evolve as evidence grows of adversaries focusing on the development of increasingly sophisticated and potentially dangerous capabilities. 
The potential for small groups to have an asymmetric impact in cyberspace creates very real incentives for malicious activity. Beyond formal governmental activities, cyber criminals can control botnets with millions of infected hosts. The tools and techniques developed by cyber criminals are increasing in sophistication at an incredible rate, and many of these capabilities can be purchased cheaply on the Internet. Whether the goal is monetary, access to intellectual property, or the disruption of critical DoD systems, the rapidly evolving threat landscape presents a complex and vital challenge for national and economic security. 

Some cyber threats also may come from insiders. Malicious insiders may exploit their access at the behest of foreign governments, terrorist groups, criminal elements, unscrupulous associates, or on their own initiative. Whether malicious insiders are committing espionage, making a political statement, or expressing personal disgruntlement, the consequences for DoD, and national security, can be devastating. 
Software and hardware are at risk of malicious tampering even before they are integrated into an operational system. The majority of information technology products used in the United States are manufactured and assembled overseas. The reliance of DoD on foreign manufacturing and development creates challenges in managing risk at points of design, manufacture, service, distribution, and disposal. 
Potential U.S. adversaries may seek to exploit, disrupt, deny, and degrade the networks and systems that DoD depends on for its operations. DoD is particularly concerned with three areas of potential adversarial activity: theft or exploitation of data; disruption or denial of access or service that affects the availability of networks, information, or network-enabled resources; and destructive action including corruption, manipulation, or direct activity that threatens to destroy or degrade networks or connected systems. 

Cyber threats to U.S. national security go well beyond military targets and affect all aspects of society. Hackers and foreign governments are increasingly able to launch sophisticated intrusions into the networks and systems that control critical civilian infrastructure. Given the integrated nature of cyberspace, computer-induced failures of power grids, transportation networks, or financial systems could cause massive physical damage and economic disruption. DoD operations—both at home and abroad—are dependent on this critical infrastructure. 
While the threat to intellectual property is often less visible than the threat to critical infrastructure, it may be the most pervasive cyber threat today. Every year, an amount of intellectual property larger than that contained in the Library of Congress is stolen from networks maintained by U.S. businesses, universities, and government departments and agencies. As military strength ultimately depends on economic vitality, sustained intellectual property losses erode both U.S. military effectiveness and national competitiveness in the global economy. 

CONCLUSION:-


National security is being redefined by cyberspace. In addition to opportunities, DoD faces significant cyberspace challenges. The Department’s military, intelligence, and business operations all depend upon cyberspace for mission success. The “Department of Defense Strategy for Operating in Cyberspace” assesses these challenges and opportunities and sets a strategic approach for DoD’s cyber mission. 
The Department’s five strategic initiatives offer a roadmap for DoD to operate effectively in cyberspace, defend national interests, and achieve national security objectives. Each initiative is distinct, yet necessarily connected with the other four. Across the strategy, activities undertaken in one initiative will contribute to DoD’s strategic thinking and lead to new approaches in the others.
By pursuing the activities in this strategy, DoD will capitalize on the opportunities afforded to the Department by cyberspace; defend DoD networks and systems against intrusions and malicious activity; support efforts to strengthen cybersecurity for interagency, international, and critical industry partners; and develop robust cyberspace capabilities and partnerships. This strategy will guide the Department’s defense of U.S. interests in cyberspace so that the United States and its allies and partners may continue to benefit from the innovations of the information age.

To read the full Department of Defense Strategy for Operating in Cyberspace Click HERE




-News Source (Defence Professionals)

SHARE OUR NEWS DIRECTLY ON SOCIAL NETWORKS:-

THC-HYDRA v6.5


THC-HYDRA is a very fast network logon cracker which support many different services. This tool is a proof of concept code, to give researchers and security consultants the possibility to show how easy it would be to gain unauthorized access from remote to a system. It was tested to compile cleanly on Linux, Windows/Cygwin, Solaris, FreeBSD and OSX

New Features of THC Hydra v6.5:-
  • Added dpl4hydra script by Roland Kessler, which creates a default password for a device. Thanks!
  • Improved HTTP form module: getting cookie, fail or success condition, follow multiple redirections, support cookie gathering URL, multiple user defined headers
  • Added interface support for IPv6, needed for connecting to link local fe80:: addresses. Works only on Linux and OS/X. Information for Solaris and *BSD welcome
  • Added -W waittime between connects option
  • The -x bruteforce mode now allows for generated password amounts > 2 billion
  • Fix if -L was used together with -x
  • Fixes for http- modules when the http-…://target/options format was used
  • Fixed a bug in the restore file write function that could lead to a crash
  • Fixed XMPP module jabber init request and challenge response check, thx “F e L o R e T”
  • Fix: if a proxy was used, unresolveable targets were disabled. now its fine
  • Fix for service://host/ usage if a colon was used after the URI without a port defined


Download THC-HYDRA v6.5 (hydra-6.5-src.tar.gz)
here.

SHARE OUR NEWS DIRECTLY ON SOCIAL NETWORKS:-

Twitter Spam Bots (#mumbaiblasts)


After the blasts in Mumbai on Wednesday evening, many turned to Twitter for the latest information. Most tweets about the explosions featured the hash tagged term #mumbaiblasts to make identifying relevant posts easier. The live-updating stream included critical information, with tweets sharing emergency phone numbers and links to a public spreadsheet where anyone who wanted to help could post their contact information.
But some of the #mumbaiblasts posts aimed to exploit the attention. Several provocative tweets like “OMG British royalty hurt in #mumbaiblast,” “#MumbaiBlasts done by Bin Laden Apparently he is not dead. See here” and “First Lady caught up in #Mumbai blasts” were posted throughout the evening and from numerous Twitter accounts. All these tweets included links to blog posts that had nothing to do with the explosions. To someone following the stream live, clicking on these links would have been a confusing experience.
But these posts weren’t trying to make sense. They just wanted clicks. These spam tweets linked to “spam blogs,” blogs that exist solely to attract as many views for their sites as possible and sell ads against them. The entities behind these blogs can use computer programs to create an army of Twitter accounts that all link back to the blogs. And while it may be particularly repugnant that spammers would capitalize on a disaster to boost their page views, it’s not unusual. If you follow any of the most popular phrases on Twitter, spam tweets will pop up, regardless of the topic. Twitter banned many of the #mumbaiblasts spam accounts shortly after they were created, but for those who were logged in as events unfolded, it was too late.
Most of the spam tweets have been removed from Twitter since we first saw them there. We went back and found them by plugging in one of the spam links to Backtweets, a site that combs Twitter to find all the tweets linking to an individual webpage. The spammers have apparently moved on to other topics like Justin Timberlake and iPads, but you can still find the #mumbaiblast spam deep in the search results.
There’s not much the average user can do to avoid falling victim to the spam’s tweet trap, except to know that if the Tweet sounds too crazy to be true, it probably is. Twitter also offers this tutorial on how to report spam accounts.

-News Source (India Real Times)

SHARE OUR NEWS DIRECTLY ON SOCIAL NETWORKS:-

Related Posts Plugin for WordPress, Blogger...