Sony Pakistan Hacked By Optik Fiber (Team Openfire)

Sony Pakistan Hacked By Optik Fiber of Team Openfire also known as Indian Cyber Force. The hacker group hacked the Database of Sony Pakistan and exposed  admin credentials and so on.
Websites:-
http://sonycenter.com.pk/

Here are some exposure submitted by Team Openfire:-

INFECTED FILE : CATEGORY.PHP
ADMIN USERNAME :- admin                                       
PASSWORD :- pa$$word

For More Information Click Here

SHARE OUR NEWS DIRECTLY ON SOCIAL NETWORKS:-
<a href=">Sony Pakistan Hacked By Optik Fiber (Team Openfire)"https://www.voiceofgreyhat.com/2011/09/sony-pakistan-hacked-by-optik-fiber.html</a>

25 Websites Defaced By jinogBD ((Bangladesh Cyber Army)

25 Websites hacked and defaced by jinogBD of BCA (Bangladesh Cyber Army)


List Of Hacked Sites:-
http://pastebin.com/8VwekLcg

SHARE OUR NEWS DIRECTLY ON SOCIAL NETWORKS:-
<a href=">25 Websites Defaced By jinogBD ((Bangladesh Cyber Army)"https://www.voiceofgreyhat.com/2011/09/25-websites-defaced-by-jinogbd.html</a>

Vulnerability Found On The Official Website of US Senate By Sec Indi Security Team

Serious vulnerability found on the official website of US Senate. Sec Indi Security Team found multiple SQL-i Vulnerable link on the US Senate website. The vulnerability has already been reported to the Authority and the admins & due to security reason we are not exposing those links.  Previously US Senate database was hacked by Lulzsec.

Website:-

http://www.senate.gov/

SHARE OUR NEWS DIRECTLY ON SOCIAL NETWORKS:-
<a href=">Vulnerability Found On The Official Website of US Senate By Sec Indi Security Team"https://www.voiceofgreyhat.com/2011/09/vulnerability-found-on-official-website.html</a>

Total 14 Zero-day Vulnerability Found in SCADA By Italian Researcher

An Italian researcher has published details of a new batch of unpatched vulnerabilities found in the SCADA (Supervisory Control and Data Acquisition) products from seven different vendors.

Assessing the significance of the 14 zero-day vulnerabilities explained by Luigi Auriemma in proof-of-concept detail with exploit code is incredibly difficult to do, but they offer an unsettling picture of the flaws that seem to exist in systems normally hidden out of sight. The companies mentioned include Beckhoff, MeasureSoft, Rockwell, Carel, Progea, AzeoTech, and Cogent, products used to control industrial systems across sectors including manufacturing, aerospace, military, and more or less any sector that might use SCADA.

Auriemma has a record of hunting down flaws in SCADA technology, having published 34 zero-day holes in March 2011. He remains unrepentant about his public disclosure of security flaws for which no patches exist.

"I like only to find them [flaws] and releasing the informations (sic) as soon as possible," he explains on his website. "And remember that I find bugs, I don't create them, the developers are the only people who create bugs (indirectly naturally) so they are ever the only responsible."

In the last year SCADA has gone from an obscure albeit important backwater of software security thanks probably to the discovery of a worm called Stuxnet, which was apparently deployed to attack systems used within the nuclear program of Iran over a year period from the summer of 2009 onwards.

Who created it and why has been speculated on ever since, but it was clear that profit-seeking criminals were an unlikely to have been behind it. With many suspecting the involvement of a government, suddenly SCADA seemed like a vulnerable underside for systems across almost every industry in the world.

SCADA exploits, meanwhile, have continued to be made public with disturbing regularity. 

-News Source (PC World & Cnet)

SHARE OUR NEWS DIRECTLY ON SOCIAL NETWORKS:-
<a href=">Total 14 Zero-day Vulnerability Found in SCADA By Italian Researcher"https://www.voiceofgreyhat.com/2011/09/total-14-zero-day-vulnerability-found.html</a>

Oracle Issued Security Update of DDoS Vulnerability in Apache HTTPD

Oracle, the giant enterprise database company - and, of course, owner of the erstwhile Sun Microsystems - has just published an out-of-band security update. This is only the fifth time Oracle has issued an alert outside its routine quarterly patch cycle since introducing its own version of Patch Tuesday at the start of 2005.

Description:-

This security alert addresses the security issue CVE-2011-3192, a denial of service vulnerability in Apache HTTPD, which is applicable to Oracle HTTP Server products based on Apache 2.0 or 2.2. This vulnerability may be remotely exploitable without authentication, i.e. it may be exploited over a network without the need for a username and password. A remote user can exploit this vulnerability to impact the availability of un-patched systems.

Affected Products and Versions:-

• Oracle Fusion Middleware 11g Release 1, versions 11.1.1.3.0, 11.1.1.4.0, 11.1.1.5.0
• Oracle Application Server 10g Release 3, version 10.1.3.5.0 (Only affected when Oracle HTTP Server 10g based on Apache 2.0 has been installed from Application Server Companion CD)
• Oracle Application Server 10g Release 2, version 10.1.2.3.0 (Only affected when Oracle HTTP Server 10g based on Apache 2.0 has been installed from Application Server Companion CD)

Please note that Oracle Enterprise Manager includes the Oracle Fusion Middleware component that is affected by this vulnerability. Oracle Enterprise Manager is affected only if the affected Oracle Fusion Middleware version (noted above) is being used. Since a vulnerability affecting Oracle Fusion Middleware versions may affect Oracle Enterprise Manager, Oracle recommends that customers apply the fix for this vulnerability to the Oracle Fusion Middleware component of Oracle Enterprise Manager. For information on what patches need to be applied to your environments, refer to Security Alert CVE-2011-3192 Patch Availability Document, My Oracle Support Note 1357871.1.

Patch Availability:-

Patches and relevant information for protection against this vulnerability can be found Here

Due to the threat posed by a successful attack, Oracle strongly recommends that customers apply Security Alert fixes as soon as possible.

-News Source (Oracle)

SHARE OUR NEWS DIRECTLY ON SOCIAL NETWORKS:-
<a href=">Oracle Issued Security Update of DDoS Vulnerability in Apache HTTPD"https://www.voiceofgreyhat.com/2011/09/oracle-issued-security-update-of-ddos.html</a>

Zeus Strategy Followed By SpyEye & Here The Victim is Android Users

In the world of Windows malware, SpyEye is a widespread malicious toolkit for creating and managing botnets. It is designed primarily for stealing banking credentials and other confidential information from infected systems. SpyEye is a major competitor of the infamous Zeus toolkit.

Zeus (also known as ZBot) generated a lot of interest in the mobile security community a couple of months ago when an Android version was discovered. Of course, we did not have to wait long before a version of SpyEye targeting Android was also developed, and sure enough a malicious SpyEye Android app was discovered a few days ago.

The functionality of Zeus and SpyEye on Windows is quite similar, so I was curious as to how similar their respective Android versions would be.

Zeus for Android purports to be a version of Trusteer Rapport security software. This social engineering trick is used in an attempt to convince the user that the application they are installing is legitimate.

SpyEye for Android, now detected by Sophos products as Andr/Spitmo-A, uses a slightly different but similar social engineering technique. When the user of a PC infected by the Windows version of SpyEye visits a targeted banking website, and when the site is using mobile transaction authorization numbers, the SpyEye Trojan may inject HTML content which will instruct the user to download and install the Android program to be used for transaction authorisation.

The SpyEye application package does not show up as an icon in the "All apps" menu, so the user will only be able to find the package when the "Manage Applications" is launched from the mobile device's settings.

The application uses the display name "System" so that it seems like a standard Android system application.

When installed, Zeus for Android displayed a fake activation screen, and Spitmo is again very similar. However, Spitmo uses different tactics to convince the user that it is a legitimate application.

It applies for the following Android permissions:-

• android.provider.Telephony.SMS_RECEIVED
• android.intent.action.NEW_OUTGOING_CALL

This allows the malware to intercept outgoing phone calls. When a number is dialed, the call is intercepted before the connection is made and the dialed phone number is matched to a special number specified by the attacker in the alleged helper application installation instructions. If the number matches, Spitmo displays a fake activation number, which is always 251340. Once installed, the functionality of Zeus and SpyEye are pretty much the same. A broadcast receiver intercepts all received SMS text messages and sends them to a command and control server using an HTTP POST request. The submitted information includes the sender's number and the full content of the message.So far, it does not seem that this attack is widespread, but it shows that the developers of major malicious toolkits are closely watching their competition and matching the latest features. It also seems that support for Android is increasingly becoming an important part of their product strategy.

-News Source (N.Security)

SHARE OUR NEWS DIRECTLY ON SOCIAL NETWORKS:-
<a href=">Zeus Strategy Followed By SpyEye & Here The Victim is Android Users"https://www.voiceofgreyhat.com/2011/09/zeus-strategy-followed-by-spyeye-here.html</a>

Leaked FBI Documents is Calling "Anonymous is A National Security Threat"

According to a PDF containing what purports to be a leaked psychological assessment of the leaders of LulzSec and Anonymous by the FBI's Behavioral Science Unit (which also profiles serial killers), Anonymous is not only not a collection of individuals, it's a coherent group that poses a threat to national security.
Neither the FBI nor Dept. of Homeland Security have commented on the "leak," which may be a fake according to the TechHerald, but seems to reflect accurately the thinking behind a series of DHS warning bulletins and crackdowns that have resulted in 75 raids and 16 arrests of Anonymous members just this year.
Anons themselves refer to the group as a rough, almost coincidental collective of individuals that occasionally cooperate on projects to protest specific things. There are approximately eight vortices of special interest within the collective, according to interviews, postings and counter-arguments posted by various Anonymi in response to invective by those it attacked.
Attacks are the work of small groups of interested individuals who, on their own initiative and using public argument as their weapon, gather like-minded Anonymi to protest governmental outrages or attack injustice in whatever form they find it, according to de facto leaders in the non-existent but vocal #OPpublicrelations.
In March, for example, members of Anonymous and 4Chan debated, in the finest traditions of American Democracy and citizen activism, whether to attack and defeat the Internet scourge that is Rebecca Black – the annoying but harmless pop "singer" whose made herself famous with a mom-and-dad-funded music video on YouTube that repeated the same lyrics so often it became apparent those might be the only words she knows.(Other, less world-shaking Anonymous projects resulted in significant attacks against the embattled governments of Egypt and Syria, the exposure of government atrocities in Bolivia, civil protest against censorship on the Bay Area Rapid Transit System, attacks on Visa, Mastercard and Paypal in support of whistleblower site WikiLeaks and a long-simmering, high-profile protest against unrestricted greed, corrosive dishonesty of Wall Street and the and economic destruction from which the rest of the country suffers while financiers continues to prosper.)
The FBI has analyzed various instant messages, forum postings, emails, Twitter posts and other documentation and decided Anonymous behaves more like a coherent organization led by a small number of powerful and focused activists, not a politically involved group of individuals using the Anonymous banner as gathering point.

• "The Anonymous ‘collective’ has risen from an amorphous group of individuals on the Internet to the current state of a potential threat to national security. Due to the nature of Anonymous, they believe that they are a leaderless collective. However, it has been shown that there is a defined leadership group," the document reads.

• "A thorough assessment of each UNSUB’s online activities, speech patterns, and general writings was collected by the FBI. Each UNSUB was individually assessed by members of the SBU (sic) and a psychological profile created from these datasets."

• Most of the members of Anonymous are under 30, but the bulk of its leadership are not teenage hacker/script-kids as many portray themselves, according to the FBI.

• "It is likely" that Sabu, one of the more vocal spokestrolls for the LulzSec mini-collective of Anonymous, "works in the information security sector and has been doing so since the early days of the internet and hacking activities. His use of net speak is interspersed with proper American English diction and grammar that implies he is an American citizen and has been educated,” the FBI notes said.

BS, quoth the Anon:

"Anonymous is not a group, it does not have leaders, people can do ANYTHING under the flag of their country," according to one member in an email interview with the AP. "Anything can be a threat to National Security, really," the member said in an email interview. "Any hacker group can be."
If the document is real, it ends on a disturbingly dangerous and presumptive conclusion: that attacks and protests by Anonymous will eventually lead to the death of members of Anonymous, law enforcement or the public that will drive many supporters away from Anonymous.
Until then, Anonymous, whether collectively or individually, may be unstoppable in practical terms.

The overall assessment for the movement however is the following:

1. The movement is out of control and there seems to be no real coherent motivation
2. The leaders have begun to hide themselves a bit more due to arrests that have been made
3. Their reliance on technology will eventually be their downfall
4. Their interpersonal relationships are weak points, as such they should be leveraged
5. Their increasing attacks on infrastructure will eventually lead to serious results that could in fact lead to deaths

-News Source (IT World)

SHARE OUR NEWS DIRECTLY ON SOCIAL NETWORKS:-
<a href=">Leaked FBI Documents is Calling "Anonymous is A National Security Threat""https://www.voiceofgreyhat.com/2011/09/leaked-fbi-documents-is-calling.html</a>