DHS & US-CERT Recommended to Disable Java in Web Browsers

DHS & US-CERT Recommended to Disable Java in Web Browsers Unless It's Absolutely Necessary

The running time is proving to be the worst period for Java, as it has been walking under serious security issues. Yet again security researchers have pointed out a zero-day security vulnerability in the Java program that hackers are exploiting. The exploit takes advantage of a vulnerability left open in Java 7 Update 10, released in October last year. It works by getting Java users to visit a website with malicious code that takes advantage of a security gap to take control of users' computers. Thus how Java is being used by cyber criminals to infect computers with malware. Oracle, hasn't specified the number of users who have downloaded Java 7 Update 10. However, Java runs on more than 850 million computers and other devices. When Oracle released Update 10, so it is predictable that more than 850 million devices run by Java is under threat. The exploit was first discovered by French researcher Kafeine, who claimed to have found it running on a site registering hundreds of thousands of page views daily. From that site, immediately that vulnerability and a large number of effected devices has been spotted in the wild. In Java 7 Update 10 the creator of Java, Oracle added several security control and fixed older bugs and promised more security enhancement, but its very unfortunate that Oracle failed to keep their promise. What ever after this newly discovered 0-day hole spotted wildly, Oracle Security Alert CVE-2013-0422 states that Java 7 Update 11 addresses this (CVE-2013-0422) and an equally severe, but distinct vulnerability (CVE-2012-3174). Immunity has indicated that only the reflection vulnerability has been fixed and that the JMX MBean vulnerability remains. Java 7u11 sets the default Java security settings to "High" so that users will be prompted before running unsigned or self-signed Java applets. It "strongly recommends" that Java SE 7 users upgrade immediately to avoid all kind of security hazards. 

After seeing all the drama, many of you have failed to keep trust in Java, and you all will be relieved when you will gone through the security advisory of CERT (Computer Emergency Response Team) where they have clearly instructed to disable Java in your popular web-browser. In their official release CERT said "Unless it is absolutely necessary to run Java in web browsers, disable it as described below, even after updating to 7u11. This will help mitigate other Java vulnerabilities that may be discovered in the future."

You will see similar advice in the advisory posted on the official DHS US-CERT website where DHS also suggested to disable Java until and unless it is that much necessary. "To defend against this and future Java vulnerabilities, consider disabling Java in web browsers until adequate updates are available. As with any software, unnecessary features should be disabled or removed as appropriate for your environment." - said U.S. CERT in their advisory. 






SHARE OUR NEWS DIRECTLY ON SOCIAL NETWORKS:-

Anonymous Hacked MIT Website & Left Tribute Message For Aaron Swartz

Anonymous Hacked MIT Website & Left Tribute Message For Aaron Swartz

We have just passed a few days when the shocking news of Aaron Swartz's suicide take down the entire Internet and specially the cyber world. Swartz, a political activist and computer programmer, reportedly hanged himself last week in his Brooklyn apartment as he awaited trial on 13 felony counts for downloading and publishing roughly 4 million academic journal articles from the database JSTOR. Hours after the Massachusetts Institute of Technology posted a pledge to investigate its involvement in events associated with the suicide of Aaron Swartz. But this step of MIT was not enough as the hacktivist group Anonymous taken this issue very seriously and started a campaign in which they targeted several websites of MIT. From 4 p.m. to 7:50 p.m. PT on Sunday evening, M.I.T.'s network lost access to most websites, including mit.edu, where Anonymous posted a red-lettered tribute message in Swartz's honor saying -

“Whether or not the government contributed to his suicide, the government’s prosecution of Swartz was a grotesque miscarriage of justice, a distorted and perverse shadow of the justice that Aaron died fighting for — freeing the publicly-funded scientific literature from a publishing system that makes it inaccessible to most of those who paid for it — enabling the collective betterment of the world through the facilitation of sharing — an ideal that we should all support,” 

Kimberly Allen, the media relations manager at M.I.T., did not immediately respond to a call from TheWrap requesting comment.
M.I.T. President Rafael Reif asked computer science professor Hal Abelson on Sunday to "lead a thorough analysis of M.I.T.'s involvement from" in Swartz's case. According to sources The Department of Justice dropped charges against Swartz on Monday, standard policy for when a defendant dies. JSTOR, which said it settled its claims against Swartz in June 2011, said it was "saddened" to hear of his death.
"We extend our heartfelt condolences to Aaron’s family, friends, and everyone who loved, knew, and admired him," it said in a post on its website. "He was a truly gifted person who made important contributions to the development of the internet and the web from which we all benefit."

Here is the full Message of Anonymous posted on MIT's website:-


"In Memoriam, Aaron Swartz, November 8, 1986 – January 11, 2013, Requiescat in pace.
A brief message from Anonymous.
Whether or not the government contributed to his suicide, the government’s prosecution of Swartz was a grotesque miscarriage of justice, a distorted and perverse shadow of the justice that Aaron died fighting for — freeing the publicly-funded scientific literature from a publishing system that makes it inaccessible to most of those who paid for it — enabling the collective betterment of the world through the facilitation of sharing — an ideal that we should all support.
Moreover, the situation Aaron found himself in highlights the injustice of U.S. computer crime laws, particularly their punishment regimes, and the highly-questionable justice of pre-trial bargaining. Aaron’s act was undoubtedly political activism; it had tragic consequences.
Our wishes
  • We call for this tragedy to be a basis for reform of computer crime laws, and the overzealous prosecutors who use them.
  • We call for this tragedy to be a basis for reform of copyright and intellectual property law, returning it to the proper principles of common good to the many, rather than private gain to the few.
  • We call for this tragedy to be a basis for greater recognition of the oppression and injustices heaped daily by certain persons and institutions of authority upon anyone who dares to stand up and be counted for their beliefs, and for greater solidarity and mutual aid in response.
  • We call for this tragedy to be a basis for a renewed and unwavering commitment to a free and unfettered internet, spared from censorship with equality of access and franchise for all.
For in the end, we will not be judged according to what we give, but according to what we keep to ourselves.
Aaron, we will sorely miss your friendship, and your help in building a better world. May you read in peace.
—-
Who was Aaron Swartz? A hero in the SOPA/PIPA campaign, Reddit cofounder, RSS, Demand Progress, Avaaz, etc…:
—-
Guerilla Open Access Manifesto
Information is power. But like all power, there are those who want to keep it for themselves. The world’s entire scientific and cultural heritage, published over centuries in books and journals, is increasingly being digitized and locked up by a handful of private corporations. Want to read the papers featuring the most famous results of the sciences? You’ll need to send enormous amounts to publishers like Reed Elsevier.
There are those struggling to change this. The Open Access Movement has fought valiantly to ensure that scientists do not sign their copyrights away but instead ensure their work is published on the Internet, under terms that allow anyone to access it. But even under the best scenarios, their work will only apply to things published in the future. Everything up until now will have been lost.
That is too high a price to pay. Forcing academics to pay money to read the work of their colleagues? Scanning entire libraries but only allowing the folks at Google to read them? Providing scientific articles to those at elite universities in the First World, but not to children in the Global South? It’s outrageous and unacceptable.
“I agree,” many say, “but what can we do? The companies hold the copyrights, they make enormous amounts of money by charging for access, and it’s perfectly legal — there’s nothing we can do to stop them.” But there is something we can, something that’s already being done: we can fight back.
Those with access to these resources — students, librarians, scientists — you have been given a privilege. You get to feed at this banquet of knowledge while the rest of the world is locked out. But you need not — indeed, morally, you cannot — keep this privilege for yourselves. You have a duty to share it with the world. And you have: trading passwords with colleagues, filling download requests for friends.
Meanwhile, those who have been locked out are not standing idly by. You have been sneaking through holes and climbing over fences, liberating the information locked up by the publishers and sharing them with your friends.
But all of this action goes on in the dark, hidden underground. It’s called stealing or piracy, as if sharing a wealth of knowledge were the moral equivalent of plundering a ship and murdering its crew. But sharing isn’t immoral — it’s a moral imperative. Only those blinded by greed would refuse to let a friend make a copy.
Large corporations, of course, are blinded by greed. The laws under which they operate require it — their shareholders would revolt at anything less. And the politicians they have bought off back them, passing laws giving them the exclusive power to decide who can make copies.
There is no justice in following unjust laws. It’s time to come into the light and, in the grand tradition of civil disobedience, declare our opposition to this private theft of public culture.
We need to take information, wherever it is stored, make our copies and share them with the world. We need to take stuff that’s out of copyright and add it to the archive. We need to buy secret databases and put them on the Web. We need to download scientific journals and upload them to file sharing networks. We need to fight for Guerilla Open Access.
With enough of us, around the world, we’ll not just send a strong message opposing the privatization of knowledge — we’ll make it a thing of the past. Will you join us?
Aaron Swartz
July 2008, Eremo, Italy
—–
You were the best of us; may you yet bring out the best in us.
-Anonymous, Jan 13, 2013.
—-
(Postscript: We tender apologies to the administrators at MIT for this temporary use of their websites. We understand that it is a time of soul-searching for all those within this great institution as much — perhaps for some involved even more so — than it is for the greater internet community. We do not consign blame or responsibility upon MIT for what has happened, but call for all those feel heavy-hearted in their proximity to this awful loss to acknowledge instead the responsibility they have — that we all have — to build and safeguard a future that would make Aaron proud, and honour the ideals and dedication that burnt so brightly within him by embodying them in thought and word and action..."


VOGH Reaction:- There is nothing much to say, we are speechless after what happened. Swartz suicide is surely a defeat of freedom. Last but not least VOGH team along with the whole cyber world will miss Aaron Swartz, RIP!


-Source (TC & Wired)






SHARE OUR NEWS DIRECTLY ON SOCIAL NETWORKS:-

Master Card Blog Hacked & defaced By Syrian Electronic Army

Master Card Payments Perspectives Blog Hacked & defaced By Syrian Electronic Army

It's became a very common scenario that hackers targets banks, payment gateway and other financial sectors. Sites like Paypal, Visa, Master Card were among those common victims who used to face massive round of cyber attacks. Past two years hacktivist managed to interrupt the service of those websites many times. Here also in the beginning of 2013 almost same situation took place, when the official blog of Master Card get hacked and defaced.  It was the Saturday evening when a hackers collective group named "Syrian Electronic Army" managed to breach and get access inside Master Card blog. I am sure that all our readers will be shocked after hearing the way of intrusion. In the platform of the blog, Master Card was using an older version of WordPress (Ver. 3.3.2) which has several critical vulnerabilities like XSS, file uploading, CSRF and so on. Exploiting those loopholes the hacker managed to get access inside the blog and defaced one of the page of the giant in international financial services company's blog. Though WordPress have released a security patch and also version 3.5, but it's quite unfortunate and shocking that Master Card did not even patched their older version for which their system get penetrated. It is truly unbelievable that sites like Master Card is so careless about basic security and counter measure of cyber attack. According to sources Syrian Electronic Army used  the CSRF exploit of WordPress which is said to be available on the Internet and allows an attacker to add a new administration user. This is a possible explanation of how the Syrian Electronic Army managed to hack and deface the blog. After this incident occurs Master Card immediately updated the version of WP and closed those back doors. Still the the defaced and cached version of the  blog can be viewed on Google’s Web Cache







SHARE OUR NEWS DIRECTLY ON SOCIAL NETWORKS:-

Yahoo Mail Hit By XSS Exploit Putting 400 Million Users At Risk

Yahoo Mail Hit By XSS Exploit Putting 400 Million Users At Risk

Yet again mistrust growing in between the large number of Yahoo users, as it has been continuously failed to protect its customers from cyber attack. Late in last year we have seen that the two major services of Yahoo get compromised, which affects millions of its registered users across the globe. First it was Yahoo Voice, which get hacked while putting 450K users at high risk. Then it was the time for Yahoo Mail, where few Egyptian hacker figured out serious XSS vulnerabilities in Yahoo Mailing service  that lets attackers steal cookies from Yahoo Webmail users. Later cyber criminals made product while exploring that loop holes, that so called product or widely known as exploit was made available at high price in underground market and forums. As expected Yahoo immediately patched these loopholes, but now it seems they did not learn lesson from the decent past. 
You all may be wondering! what happened? Again the security of Yahoo fallen victim in front of hackers.  Shahin Ramezany, a hacker and independent security researcher have figure out a DOM-Based XSS vulnerability in Yahoo Mail that is exploitable in all major browsers. Ramezany tweeted about this issue whihc links to an YouTube video, where he demonstrated the hack. Shahin Ramezany also claimed that the exploit have put more than 400 Million yahoo users at risk


As soon as this story get spotted, Yahoo immediately responds the matter, in their official release a Yahoo spokesman said "We’ve been looking into it and the US have now confirmed that they are investigating too. They will be in touch if there is a comment – otherwise I recommend that if users are concerned then they should change their passwords immediately." 

Later Yahoo said that thy have plugged the security hole. In their statement the spokesperson added, “At Yahoo! we take security very seriously and invest heavily in measures to protect our users and their data. We were recently informed of an online video that demonstrated a vulnerability. We confirm that the vulnerability has been fixed. In addition, we are investigating recent reports of increased abusive traffic and will work diligently to fix any vulnerabilities that are found. Concerned users are encouraged to change their passwords to a safe password that combines letters, numbers, and symbols.”

But this issue did not get completely resolved, as immediately after the fix release of Yahoo, Shahin Ramezany said that the fix is not good enough, and the Yahoo Mail exploit is still active. In his twitter he said "not effective enough and users are still [at] risk," since the proof-of-concept code can be easily tweaked to continue attacks. 





SHARE OUR NEWS DIRECTLY ON SOCIAL NETWORKS:-

EU Opens The Door of European Cybercrime Centre (EC3) To Protect Europe From Cyber Threat

EU Opens The Door of European Cybercrime Centre (EC3) To Protect Europe From Cyber Threat

We all are aware of FBI's Internet Crime Complaint Center also known as IC3, which is protecting U.S. citizen from cyber criminals and attacks. But the cyber world is not limited to U.S. so as cyber criminals, and to get rid of this and while protecting every countries digital fence safe and secure there need to be organizations like IC3. All the growing and developing countries across the globe are in rush to ensue maximum digital and cyber security. This same rush and impact also applies for Europe countries and the result is in front of us. As the fight against cyber crime in Europe has got a new home. The European Cybercrime Centre (EC3) officially open its doors from this January 11, at the European Police Office, Europol in the Hague. In the middle of last year European Commission declared that are preparing a cybercrime center to fight against cyber threats. And after an effort of six months they made it possible and live for the people of Europe. Such organization will surely enhance the cyber security of European countries.  In the official press release EUROPA said "EC3 will be up and running to help protect European citizens and businesses from cyber-crime." 

EC3 officially commenced its activities on 1 January 2013 with a mandate to tackle the following areas of cybercrime: 
  • That committed by organised groups to generate large criminal profits such as online fraud
  • That which causes serious harm to the victim such as online child sexual exploitation
  • That which affects critical infrastructure and information systems in the European Union

According to the press release of European Commission - "The Cybercrime Centre will give a strong boost to the EU's capacity to fight cybercrime and defend an internet that is free, open and secure. Cybercriminals are smart and quick in using new technologies for criminal purposes; the EC3 will help us become even smarter and quicker to help prevent and fight their crimes", said Commissioner Malmström.
"In combatting cybercrime, with its borderless nature and huge ability for the criminals to hide, we need a flexible and adequate response. The European Cybercrime Centre is designed to deliver this expertise as a fusion centre, as a centre for operational investigative and forensic support, but also through its ability to mobilise all relevant resources in EU Member States to mitigate and reduce the threat from cybercriminals wherever they operate from", said Troels Oerting, Head of the European Cybercrime Centre
Investigations into online fraud, child abuse online and other cybercrimes regularly involve hundreds of victims at a time, and suspects in many different parts of the world. Operations of this magnitude cannot be successfully concluded by national police forces alone.
The opening of the European Cybercrime Centre (EC3) marks a significant shift in how the EU has been addressing cybercrime so far. Above all, the approach of the EC3 will be more forward-thinking and inclusive. It will pool expertise and information, support criminal investigations and promote EU-wide solutions.
The EC3 will focus on illegal online activities carried out by organised crime groups, especially attacks targeting e-banking and other online financial activities, online child sexual exploitation and those crimes that affect the critical infrastructure and information systems in the EU.
The Centre will also facilitate research and development and ensure capacity building among law enforcement, judges and prosecutors and will produce threat assessments, including trend analyses, forecasts and early warnings. In order to dismantle more cybercrime networks and prosecute more suspects, the EC3 will gather and process cybercrime related data and will provide a Cybercrime Help desk for EU countries' law enforcement units. It will offer operational support to EU countries (e.g. against intrusion, fraud, online child sexual abuse, etc.) and deliver high-level technical, analytical and forensic expertise in EU joint investigations. 

For Detailed Information Please Visit The Official Website of Europol's EC3 



SHARE OUR NEWS DIRECTLY ON SOCIAL NETWORKS:-

FBI Wanted Cyber Criminal Hamza Bendelladj Arrested in Thailand

FBI Wanted Cyber Criminal Hamza Bendelladj Arrested in Thailand

Another FBI listed cyber criminal get nabbed. The suspect named Hamza Bendelladj of 24 yrs have been arrested in late Sunday night during a layover at Thailand’s international airport while traveling from Malaysia to Egypt. According to the officials Bendelladj is an Algerian national wanted by the United States Federal Bureau of Investigation (FBI) for allegedly making tens of millions of dollars from cyber crime. Police confiscated two laptops, a tablet computer, a satellite phone and a number of external hard drives from Bendelladj. According to the officials FBI had been pursuing Bendelladj for nearly three years. U.S. authorities believe the suspect hacked private accounts in more than 217 banks and financial companies worldwide, causing about $10 million in losses per transaction. After this arrest, he will be extradited to the U.S. state of Georgia, where a district court has issued an arrest warrant. In an exclusive report Bangkok Post said -a smiling Bendelladj, who was present at the press conference, denied claims by the Thai authorities that he was on the FBI's top-10 most wanted list. "I'm not in the top 10, maybe just 20th or 50th," the Algerian suspect said with a laugh. "I am not a terrorist."



SHARE OUR NEWS DIRECTLY ON SOCIAL NETWORKS:-

Official Website of Senator Vicente C. Sotto III Hacked By Anonymous Philippines

Official Website of Senator Vicente C. Sotto III Hacked By Anonymous Philippines

Philippines rampage of hacktivist Anonymous continues, as this hacker collective group strikes again and blown the official website of Senator Vicente C. Sotto III. This attack carried under the banner of 'OccupyPhilippines' where the hacker group hacked into server of Senator Tito Sotto and defaced the index page. According to the hacker, the cyber attack was to stand against the controversial "Cybercrime Prevention Act of Philippines" widely known as Republic Act No. 10175. The hacker group believed that, if this bill did not get revised, then the freedom of speech in cyber space will be restricted. During this attack the hacker tried to send his message to the Senator, and that is - 

"It's been a long time, Tito Sen! Deny us our freedom of speech and of expression through R.A. 10175 
and we will deny you your cyberspace. You cannot shut us up, you cannot shut us down. 
And you shall not see us rest until R.A. 10175 is revised.
We are all waiting, we are all ready.
We are Anonymous, we are legion.
We do not forgive and we do not forget.
Expect Us
Protect our Right to Freedom of Expression!..."

The attack took place in yesterday evening, as soon as the intrusion was spotted the site was sent offline for a certain period. And today morning, the whole thing get restored and it came back to its normal format. 




SHARE OUR NEWS DIRECTLY ON SOCIAL NETWORKS:-

Related Posts Plugin for WordPress, Blogger...