SQL Injection Vulnerability Affected All Versions of Ruby on Rails

SQL Injection Vulnerability Affected All Versions of Ruby on Rails (CVE-2012-5664)

Developers at Ruby on Rails are warning its users regarding a Sql Injection flaws which has affected all the current version of Ruby on Rails web framework. While exploiting the vulnerability an attacker can inject and even execute malicious codes into the web application. "Due to the way dynamic finders in Active Record extract options from method parameters, a method parameter can mistakenly be used as a scope. Carefully crafted requests can use the scope to inject arbitrary SQL," explained the Rails framework's developers. As soon as this vulnerability has been spotted in the wild, the maintainers of Ruby on Rails have released new versions that addresses the flaw, versions 3.2.10, 3.1.9 and 3.0.18. In their advisory Ruby on Rails team recommends that users running affected versions, which is essentially anyone using Ruby on Rails, upgrade immediately to one of the fixed versions mentioned earlier. "We're sorry to drop a release like this so close to the holidays but regrettably the exploit has already been publicly disclosed and we don't feel we can delay the release," Rails developer concluded. 

The original problem was disclosed on the Phenoelit blog in late December where the author applied the technique to extract user credentials from a Ruby on Rails system, circumventing the authlogic authentication framework. While talking about the vulnerability discloser of Ruby on Rails, we would like to remind you that, this is not the first time, earlier in 2012 a Russian security researcher named Homakov has found that Github has succumbed to a public key vulnerability in Ruby on Rails which is allowing a normal user to gain administrator access into the popular Rails Git.

Brief About Ruby on Rails:- Ruby on Rails, often shortened to Rails, is an open source full-stack web application framework for the Ruby programming language. Ruby on Rails runs on the general-purpose programming language Ruby, which predates it by more than a decade. Rails is a full-stack framework, meaning that it gives the web developer the ability to gather information from the web server, talk to or query the database, and render templates out of the box. As a result, Rails features a routing system that is independent of the web server. Ruby on Rails emphasizes the use of well-known software engineering patterns and principles, such as Active record pattern, Convention over Configuration, Don't Repeat Yourself and Model-View-Controller.

SHARE OUR NEWS DIRECTLY ON SOCIAL NETWORKS:-
<a href=">SQL Injection Vulnerability Affected All Versions of Ruby on Rails"https://www.voiceofgreyhat.com/2013/01/SQL-Injection-Vulnerability-in-Ruby-on-Rails.html</a>

Citi Bank & Bank of America Faced Sent Offline After Massive DDoS Attack (Operation Ababil)

Citi Bank & Bank of America Faced Sent Offline After Massive DDoS Attack (Operation Ababil)

Late in last year we have reported that major banking and finical sector of America faced massive cyber attack. The attack came just after 'anti Islamic' video was posted online. During the time of attack the hacker group named 'Izz ad-Din al Qassam Cyber Fighters' said "these series of attacks will continue until the Erasing of that nasty movie from the Internet". But now its seems that, the earlier deceleration of the hacker collective group was fake, as they again engaged denial of service attack against large banking sector, where Citi Bank and Bank of America fallen victim. Several website of those above banks were reported offline for a certain period of time. "Just moments ago Izz ad-Din al-Qassam Cyber Fighters attacked CitiBank and made all the parts out of reach. This was the 2nd attack this day. Banks could not stop al-Qassam Cyber fighters this week" - said the hacker group in their blog. In thier blog Hilf-ol-Fozoul reports that on Thursday several domains of Citi Bank such as citicards.com, citibank.com and citi.com were inaccessible during the pick hours. "In the 3rd week from Operation Ababil, Bank of America faced technical difficulties due to heavy traffic made by al - Qassam Cyber Fighters and users can no more reach the site." said the hackers. 

The Citi Bank’s representatives acknowledged the cyber attack while saying “Currently we are aware & are working on technical issues with Citi websites. We will let you know when service is fully restored. We apologize for the inconvenience. Please call the number on the back of your card if you need immediate assistance,” on Twitter. But the representatives of Bank of America have not issued any statements on the matter.

SHARE OUR NEWS DIRECTLY ON SOCIAL NETWORKS:-
<a href=">Citi Bank & Bank of America Faced Sent Offline After Massive DDoS Attack (Operation Ababil)"https://www.voiceofgreyhat.com/2013/01/Citi-Bank-Bank-of-America-Faced-DDoS-Attack.html</a>

Ministry of Defense Argentina Hacked By LulzSec Peru, Sensitive Information (Aircraft, Submarines, Weapons) Leaked

Ministry of Defense Argentina Hacked By LulzSec Peru, Sensitive Information (Aircraft, Submarines, Weapons) Leaked

A hacktivist group claiming to be the part of infamous LulzSec, targeted the official website of Argentinian Ministry of Defense. This round of cyber attack taken sensitive data from Ministry of Defense server, along with that the index page also get defaced by the hacker group calling them selves 'LulzSec Peru'. The leaked data, allegedly said “top secret” documents from the ministry’s systems has been posted on AnonPaste. The total leak is almost 100 megabytes in size, contains information on submarines, radars and weapons. It also contains user details such as usernames, passwords, the names of officials and other sensitive information. The release on AnonPaste also did satire of the cyber security system of Argentinian Ministry while saying "According to statements by the DEPARTMENT OF ARGENTINA DEFENSE the computer systems area say they had a system impossible to hack, thing turned otherwise. The event should not be taken as terrorism, was for the simple fact to prove that the system was totally vulnerable. The documents contain highly sensitive material rated SECRET (aircraft, submarines, guns)..."

As per sources the data dump, leaked by the hacker was indeed stolen from Ministry's system, also the deface mirror on Zone-H is showing that the official website was indeed hacked and defaced. Though the officials of Argentinian Ministry did not commented about this incident. After the hack was spotted on the wild, the authorities restored their system, and the website came back to its normal format very soon. 

SHARE OUR NEWS DIRECTLY ON SOCIAL NETWORKS:-
<a href=">Ministry of Defense Argentina Hacked By LulzSec Peru, Sensitive Information (Aircraft, Submarines, Weapons) Leaked"https://www.voiceofgreyhat.com/2013/01/Ministry-of-Defense-Argentina-Hacked.html</a>

Microsoft Security Advisory (2794220) Remote Code Execution Vulnerability in Internet Explorer Fixed

Microsoft Security Advisory (2794220) Remote Code Execution Vulnerability in Internet Explorer Fixed

The Redmond based software giant Microsoft issued an urgent security advisory to address vulnerabilities in its popular web-browser that is Internet Explorer.  Few of days new “zero day” security hole in IE was discovered which could potentially allow hackers to take over control of your system when all you've done is visit an infected website. The vulnerability affects IE versions 6, 7 and 8. Though the latest versions of the browser, that means IE 9 and 10, are not affected. “An attacker who successfully exploited this vulnerability could gain the same user rights as the current user.” Microsoft said in its statement. The statement went on to say, “an attacker could host a website that contains a webpage that is used to exploit this vulnerability. In addition, compromised websites and websites that accept or host user-provided content or advertisements could contain specially crafted content that could exploit this vulnerability.”

On its advisory Microsoft first issued warning of the problem, which involves how IE accesses "an object in memory that has been deleted or has not been properly allocated." The problem corrupts the browser's memory, allowing attackers to execute their own code. Security vendor Symantec described such a scenario as a "watering hole" attack, where victims are profiled and then lured to the malicious site. Last week, one of the websites discovered to have been rigged to delivered an attack was that of the Council on Foreign Relations, a renowned foreign policy think tank. 

While talking about IE and its bugs, then we would like to remind you that couple of weeks ago, Spider.io a website analytics firm has discovered a security vulnerability in all current versions of Internet Explorer that allows attackers to trace mouse cursors anywhere on users' screens even if the Internet Explorer window is minimized. That time the software giant ignored that particular issue. But here they take this one bit seriously; So if you still using the older and affected version of IE, then its time to update your browser, in order to stay safe and secure on the Internet. To update your browser or to access the security fix click Here. 

SHARE OUR NEWS DIRECTLY ON SOCIAL NETWORKS:-
<a href=">Microsoft Security Advisory (2794220) Remote Code Execution Vulnerability in Internet Explorer Fixed"https://www.voiceofgreyhat.com/2013/01/Vulnerability-in-Internet-Explorer-Fixed.html</a>

‘Pervasive Vulnerability’ Found in The Robotic Aircraft of Drone Fleet

 ‘Pervasive Vulnerability’ Found in  The Robotic Aircraft of Drone Fleet

Unmanned aerial vehicle (UAV), widely known as a drone has always been gone through with several controversies in case of both defense and cyber security. Yet again several question arises regarding the security system and the control algorithms of drone. According to the Pentagon’s premier science and technology division a a “pervasive vulnerability” have been found in the robotic aircraft of drone. The control algorithms for these crucial machines are written in a fundamentally insecure manner, says Dr. Kathleen Fisher, a Tufts University computer scientist and a program manager at the Defense Advanced Research Projects Agency. There’s simply no systematic way for programmers to check for vulnerabilities as they put together the software that runs our drones, our trucks or our pacemakers.

In our homes and our offices, this weakness is only a medium-sized deal: developers can release a patched version of Safari or Microsoft Word whenever they find a hole; anti-virus and intrusion-detection systems can handle many other threats. But updating the control software on a drone means practically re-certifying the entire aircraft. And those security programs often introduce all sorts of new vulnerabilities. “The traditional approaches to security won’t work,” Fisher tells Danger Room.

Fisher is spearheading a far-flung, $60 million, four-year effort to try to develop a new, secure way of coding and then run that software on a series of drones and ground robots. It’s called High-Assurance Cyber Military Systems, or HACMS. For detailed information about this story click Here. 

While talking about drone and its security we would like to give you reminder that in 2011 we came to know that a stealthy key-logger has hit the U.S. Drone logging pilots’ every keystroke as they remotely fly missions over Afghanistan and other war zones. Later Iran took responsibility of that cyber attack. Also in 2012 drone was in controversy where researcher have figured out that drone fleets are vulnerable to GPS spoofing and it can be hijacked by any malicious attacker or terrorist. 

SHARE OUR NEWS DIRECTLY ON SOCIAL NETWORKS:-
<a href="> ‘Pervasive Vulnerability’ Found in The Robotic Aircraft of Drone Fleet"https://www.voiceofgreyhat.com/2013/01/Pervasive-Vulnerability-Found-in-Drone.html</a>

'Mickey Virus' The Upcoming Bollywood Movie Based on Hacking

'Mickey Virus' The Upcoming Bollywood Movie Based on Hacking 

'Mickey Virus' many of you may think it may be the name of another cyber threat, but let me assure you that; its not a virus or cyber threat. Mickey Virus is the name of an upcoming Bollywood movie based of hacking and cyber world. Sounds interesting, yes it is as this is the first Indian movie which have been subjected to such fields. Before Mickey Virus, we have seen several Indian movies where the matter hacking have been shown, among them we can take the name of  16 DECEMBER, Players & so on. But the main difference between those movies and Mickey Virus will be, here the main story is based on cyber world and specially hacking. According to sources popular television anchor Manish Paul is set to make his Bollywood debut with "Mickey Virus", where he plays a computer hacker. The film hits the screens May 17. Directed by debutant Saurabh Verma, the film also features actor Manish Chaudhary of "Rocket Singh: Salesman Of The Year" fame. "The film is called 'Mickey Virus' and Manish Paul has acted in it. Other than this, we have Manish Chaudhary, who was also there in 'Rocket Singh...'," Verma told IANS.

With Delhi as its backdrop, the story of the film revolves around computer hackers. Asked if Verma harboured any apprehensions since the cast and the crew of the film are relatively new, he said: "I have no apprehensions. The film is such, it has been made for people like us. It is extremely interesting." Verma has been in showbiz for the past 15 years, but was involved in the distribution and production aspects of the film industry. "I always had this movie in mind. I have been in this business for many years now. This film was not made overnight. The pre-production itself took about six months," he said.

SHARE OUR NEWS DIRECTLY ON SOCIAL NETWORKS:-
<a href=">'Mickey Virus' The Upcoming Bollywood Movie Based on Hacking"https://www.voiceofgreyhat.com/2013/01/Mickey-Virus-Upcoming-Hacking-Movie.html</a>

American Farm Bureau Federation (AFBF) Official Site Hacked & Infected With Malware

American Farm Bureau Federation (AFBF) Official Site Hacked & Infected With Malware 

The official website of American Farm Bureau have been fallen victim to cyber criminals. If you try to visit the farm Bureau site we have to face a malware warning as shown in the picture below.. 

According to sources some unnamed hacker managed to breach the server of Farm Bureau and infected that with malware. So far the reason of this cyber attack is unknown, but according to sources the American Farm Bureau Federation  (AFBF) authority did not released any press statement or neither commented about the breach. The attack took place in the night of first January, but still the index page of the site is showing virus warning. The last update is saying that the AFBF cyber team is restoring the server. 

Brief about AFBF:- The American Farm Bureau Federation (AFBF), commonly referred to as the Farm Bureau, is a nonprofit organization and the largest general farm organization in the United States. The stated mission of AFBF is "working through our grassroots organizations to enhance and strengthen the lives of rural Americans and to build strong, prosperous agricultural communities." AFBF is headquartered in Washington, DC. There are 50 state Farm Bureau affiliates and one in Puerto Rico.

SHARE OUR NEWS DIRECTLY ON SOCIAL NETWORKS:-
<a href=">American Farm Bureau Federation (AFBF) Official Site Hacked & Infected With Malware"https://www.voiceofgreyhat.com/2013/01/Farm-Bureau-Federation-Hacked-Infected-With-Malware.html</a>