Pwn2Own 2013 -Hack Major Browser, Adobe Reader, Flash or Java & Earn in Million Dollars


Pwn2Own 2013 -Hack Major Web-browser, Adobe Reader, Flash or Java & Earn in Million Dollars 

Since the last two years the Pwn2Own hacker contest has become an important fixture in the world of testing the security of software applications, operating systems and hardware devices. In last two years we have seen several hackers, security professionals have expressed their enthusiasm and joined Pwn2Own where four major and widely browser's security get compromised, in order to make applications, software more safe and secure. Last year we have reported how different hackers across the globe taken part in Pwn2Own and successfully hacked Google Chrome, IE & Firefox, and earned millions of dollars. But the contest of this year has some more twist than before as, HP TippingPoint and Google, sponsor of Pwn2Own, has made clear that it is expanding the focus of the competition beyond browsers. Also, Pwn2own 2013 will include $560,000 in prize money for demonstrations of exploits in the major web browsers, Adobe Reader, Adobe Flash or Oracle Java

Contest Dates:-

The contest will take place the 6th, 7th, and 8th of March in Vancouver, British Columbia during the CanSecWest 2013 conference. DVLabs blog post will be updated as the contest plays out and get real-time updates by following either @thezdi or @Pwn2Own_Contest on Twitter or search for the hash tag #pwn2own.

Rules & Prizes:-

HP ZDI is offering more than half a million dollars (USD) in cash and prizes during the competition for vulnerabilities and exploitation techniques in the below categories. The first contestant to successfully compromise a selected target will win the prizes for the category.
  • Web Browser
    • Google Chrome on Windows 7 ($100,000)
    • Microsoft Internet Explorer, either
      • IE 10 on Windows 8 ($100,000), or
      • IE 9 on Windows 7 ($75,000)
    • Mozilla Firefox on Windows 7 ($60,000)
    • Apple Safari on OS X Mountain Lion ($65,000)
  • Web Browser Plug-ins using Internet Explorer 9 on Windows 7
    • Adobe Reader XI ($70,000)
    • Adobe Flash ($70,000)
    • Oracle Java ($20,000)
The targets will be running on the latest, fully patched version of the Windows 7, 8, and OS X Mountain Lion. All targets will be installed in their default configurations, as this is how a majority of users will have them configured. As always, the vulnerabilities utilized in the attack must be unknown and not previously reported to the vendor. If a sandbox is present, a full sandbox escape is required to win. A given vulnerability may only be used once across all categories.
Upon successful demonstration of the exploit, the contestant will provide HP ZDI a fully functioning exploit and all the details of the vulnerability used in the attack. In the case that multiple vulnerabilities were exploited to gain code execution, details about all the vulnerabilities (memory corruption, infoleaks, escalations, etc.) leveraged and the sequence in which they are used must be provided to receive the prize money. The initial vulnerability utilized in the attack must be in the registered category.
Along with prize money, the contestant will receive the compromised laptop and 20,000 ZDI reward points* which immediately qualifies them for Silver standing. 

Full contest rules can be found at http://dvlabs.tippingpoint.com/Pwn2OwnContestRules.html, and may be changed at any time without notice.

Registration:-
Contestants are asked to pre-register by contacting ZDI via e-mail at zdi@hp.com. This will allow the organizer to ensure that they have the necessary resources in place to facilitate the attack. If more than one contestant registers for a given category, the order of the contestants will be drawn at random.








SHARE OUR NEWS DIRECTLY ON SOCIAL NETWORKS:-

WikiLeaks Tweet Revealed- Aaron Swartz Was an Ally & Possible Source of WikiLeaks

WikiLeaks Tweet Revealed- Aaron Swartz Was an Ally & Possible Source of WikiLeaks 

WikiLeaks, the organization who used to dig the truth and bring them in front, has disclosed a sensational matter while saying that the late internet activist and renowned hacker Aaron Swartz who committed suicide a few weeks ago was possibly an active worker and source for WikiLeaks

Over the weekend, in a series of tweets, WikiLeaks said that activist and hacker Swartz, who committed suicide earlier this month while awaiting trial on computer fraud charges, "assisted" the organization and "was in communication with Julian Assange, including during 2010 and 2011,"  

Unfortunately those tweets did not go so far as to name Swartz as a WikiLeaks source, only saying, "We have strong reasons to believe, but cannot prove, that" he was. 

WikiLeaks -globally famous for exposing classified classified and top secrete documents of several government said it decided to reveal these details in light of the US Secret Service's involvement in Swartz's  case. At the time of his death, Swartz was awaiting trial for allegedly harvesting millions of scholarly articles over the Massachusetts Institute of Technology's network. He was charged with computer fraud and other crimes in July 2011, and faced up to 35 years in prison. 
Although WikiLeaks doesn't elaborate on its decision, the organization has a policy of maintaining anonymity for its sources. "As far as we can ascertain, WikiLeaks has never revealed any of its sources," according to its website. "We cannot provide details about the security of our media organization or its anonymous drop box for sources because to do so would help those who would like to compromise the security of our organization and its sources."  But after these round of tweets we can say that Wikileaks may have broken its own rules of anonymity by doxxing (removing the anonymity) of Swartz as an ally and possible source. 






SHARE OUR NEWS DIRECTLY ON SOCIAL NETWORKS:-

Anonymous Targeted Mexican Defense, Navy & Ministry Websites

Anonymous Targeted Mexican Defense, Navy & Ministry Websites 

The whole cyber world can be the witness of bitter relation between hacker collective group Anonymous and the Mexican government. We those who used to observe the cyber domain have already seen several protest campaign came from Anonymous against Mexico, whether it was the Pope or Mexican Drug Cartels or Mexican Govt. sponsored bus organization. Here again the same thing get repeated when the infamous Anonymous targeted  several web sites of Mexico’s defense and navy departments. 
The name of the group "Anonymous Mexico" was visible on the website in front of a black background, with phrases from the manifesto of the Zapatista National Liberation Army (EZLN). The group MexicanH Team, which identified itself as part of Anonymous Mexico, said on Twitter that it had hacked and "defaced" the ministry website. In another Twitter account, the group Anonymous Hispano, which uses the handle @anonophispano, claimed that "the entire content" of the defense ministry server was hacked and that it will be "released soon." 
“Brothers and sisters, let’s raise our voices for a Mexico free of corruption, free of crime,” the message said. “Let’s show the world that were are one, we are everyone. We are anonymous. We are legion. We don’t forgive. We don’t forget. Wait for us!” -added by the hacker. 
In response of hacking, the Defense Ministry responded that its website was “momentarily out of service” but did not explain why and did not refer to the hacking claim. But on the other hand the Mexican Navy accommodated the cyber attack and said that- its web site was targeted only by a simple denial-of-service, attack and that no sensitive information was compromised. Later Sedena issued a statement hours later saying that while its Web site was indeed temporarily down, but the department’s internal information and communication systems were “functioning with complete normality.” And After couple of hours all the services and website came back live with proper functionality. 





SHARE OUR NEWS DIRECTLY ON SOCIAL NETWORKS:-

DHS & US-CERT Recommended to Disable Java in Web Browsers

DHS & US-CERT Recommended to Disable Java in Web Browsers Unless It's Absolutely Necessary

The running time is proving to be the worst period for Java, as it has been walking under serious security issues. Yet again security researchers have pointed out a zero-day security vulnerability in the Java program that hackers are exploiting. The exploit takes advantage of a vulnerability left open in Java 7 Update 10, released in October last year. It works by getting Java users to visit a website with malicious code that takes advantage of a security gap to take control of users' computers. Thus how Java is being used by cyber criminals to infect computers with malware. Oracle, hasn't specified the number of users who have downloaded Java 7 Update 10. However, Java runs on more than 850 million computers and other devices. When Oracle released Update 10, so it is predictable that more than 850 million devices run by Java is under threat. The exploit was first discovered by French researcher Kafeine, who claimed to have found it running on a site registering hundreds of thousands of page views daily. From that site, immediately that vulnerability and a large number of effected devices has been spotted in the wild. In Java 7 Update 10 the creator of Java, Oracle added several security control and fixed older bugs and promised more security enhancement, but its very unfortunate that Oracle failed to keep their promise. What ever after this newly discovered 0-day hole spotted wildly, Oracle Security Alert CVE-2013-0422 states that Java 7 Update 11 addresses this (CVE-2013-0422) and an equally severe, but distinct vulnerability (CVE-2012-3174). Immunity has indicated that only the reflection vulnerability has been fixed and that the JMX MBean vulnerability remains. Java 7u11 sets the default Java security settings to "High" so that users will be prompted before running unsigned or self-signed Java applets. It "strongly recommends" that Java SE 7 users upgrade immediately to avoid all kind of security hazards. 

After seeing all the drama, many of you have failed to keep trust in Java, and you all will be relieved when you will gone through the security advisory of CERT (Computer Emergency Response Team) where they have clearly instructed to disable Java in your popular web-browser. In their official release CERT said "Unless it is absolutely necessary to run Java in web browsers, disable it as described below, even after updating to 7u11. This will help mitigate other Java vulnerabilities that may be discovered in the future."

You will see similar advice in the advisory posted on the official DHS US-CERT website where DHS also suggested to disable Java until and unless it is that much necessary. "To defend against this and future Java vulnerabilities, consider disabling Java in web browsers until adequate updates are available. As with any software, unnecessary features should be disabled or removed as appropriate for your environment." - said U.S. CERT in their advisory. 






SHARE OUR NEWS DIRECTLY ON SOCIAL NETWORKS:-

Anonymous Hacked MIT Website & Left Tribute Message For Aaron Swartz

Anonymous Hacked MIT Website & Left Tribute Message For Aaron Swartz

We have just passed a few days when the shocking news of Aaron Swartz's suicide take down the entire Internet and specially the cyber world. Swartz, a political activist and computer programmer, reportedly hanged himself last week in his Brooklyn apartment as he awaited trial on 13 felony counts for downloading and publishing roughly 4 million academic journal articles from the database JSTOR. Hours after the Massachusetts Institute of Technology posted a pledge to investigate its involvement in events associated with the suicide of Aaron Swartz. But this step of MIT was not enough as the hacktivist group Anonymous taken this issue very seriously and started a campaign in which they targeted several websites of MIT. From 4 p.m. to 7:50 p.m. PT on Sunday evening, M.I.T.'s network lost access to most websites, including mit.edu, where Anonymous posted a red-lettered tribute message in Swartz's honor saying -

“Whether or not the government contributed to his suicide, the government’s prosecution of Swartz was a grotesque miscarriage of justice, a distorted and perverse shadow of the justice that Aaron died fighting for — freeing the publicly-funded scientific literature from a publishing system that makes it inaccessible to most of those who paid for it — enabling the collective betterment of the world through the facilitation of sharing — an ideal that we should all support,” 

Kimberly Allen, the media relations manager at M.I.T., did not immediately respond to a call from TheWrap requesting comment.
M.I.T. President Rafael Reif asked computer science professor Hal Abelson on Sunday to "lead a thorough analysis of M.I.T.'s involvement from" in Swartz's case. According to sources The Department of Justice dropped charges against Swartz on Monday, standard policy for when a defendant dies. JSTOR, which said it settled its claims against Swartz in June 2011, said it was "saddened" to hear of his death.
"We extend our heartfelt condolences to Aaron’s family, friends, and everyone who loved, knew, and admired him," it said in a post on its website. "He was a truly gifted person who made important contributions to the development of the internet and the web from which we all benefit."

Here is the full Message of Anonymous posted on MIT's website:-


"In Memoriam, Aaron Swartz, November 8, 1986 – January 11, 2013, Requiescat in pace.
A brief message from Anonymous.
Whether or not the government contributed to his suicide, the government’s prosecution of Swartz was a grotesque miscarriage of justice, a distorted and perverse shadow of the justice that Aaron died fighting for — freeing the publicly-funded scientific literature from a publishing system that makes it inaccessible to most of those who paid for it — enabling the collective betterment of the world through the facilitation of sharing — an ideal that we should all support.
Moreover, the situation Aaron found himself in highlights the injustice of U.S. computer crime laws, particularly their punishment regimes, and the highly-questionable justice of pre-trial bargaining. Aaron’s act was undoubtedly political activism; it had tragic consequences.
Our wishes
  • We call for this tragedy to be a basis for reform of computer crime laws, and the overzealous prosecutors who use them.
  • We call for this tragedy to be a basis for reform of copyright and intellectual property law, returning it to the proper principles of common good to the many, rather than private gain to the few.
  • We call for this tragedy to be a basis for greater recognition of the oppression and injustices heaped daily by certain persons and institutions of authority upon anyone who dares to stand up and be counted for their beliefs, and for greater solidarity and mutual aid in response.
  • We call for this tragedy to be a basis for a renewed and unwavering commitment to a free and unfettered internet, spared from censorship with equality of access and franchise for all.
For in the end, we will not be judged according to what we give, but according to what we keep to ourselves.
Aaron, we will sorely miss your friendship, and your help in building a better world. May you read in peace.
—-
Who was Aaron Swartz? A hero in the SOPA/PIPA campaign, Reddit cofounder, RSS, Demand Progress, Avaaz, etc…:
—-
Guerilla Open Access Manifesto
Information is power. But like all power, there are those who want to keep it for themselves. The world’s entire scientific and cultural heritage, published over centuries in books and journals, is increasingly being digitized and locked up by a handful of private corporations. Want to read the papers featuring the most famous results of the sciences? You’ll need to send enormous amounts to publishers like Reed Elsevier.
There are those struggling to change this. The Open Access Movement has fought valiantly to ensure that scientists do not sign their copyrights away but instead ensure their work is published on the Internet, under terms that allow anyone to access it. But even under the best scenarios, their work will only apply to things published in the future. Everything up until now will have been lost.
That is too high a price to pay. Forcing academics to pay money to read the work of their colleagues? Scanning entire libraries but only allowing the folks at Google to read them? Providing scientific articles to those at elite universities in the First World, but not to children in the Global South? It’s outrageous and unacceptable.
“I agree,” many say, “but what can we do? The companies hold the copyrights, they make enormous amounts of money by charging for access, and it’s perfectly legal — there’s nothing we can do to stop them.” But there is something we can, something that’s already being done: we can fight back.
Those with access to these resources — students, librarians, scientists — you have been given a privilege. You get to feed at this banquet of knowledge while the rest of the world is locked out. But you need not — indeed, morally, you cannot — keep this privilege for yourselves. You have a duty to share it with the world. And you have: trading passwords with colleagues, filling download requests for friends.
Meanwhile, those who have been locked out are not standing idly by. You have been sneaking through holes and climbing over fences, liberating the information locked up by the publishers and sharing them with your friends.
But all of this action goes on in the dark, hidden underground. It’s called stealing or piracy, as if sharing a wealth of knowledge were the moral equivalent of plundering a ship and murdering its crew. But sharing isn’t immoral — it’s a moral imperative. Only those blinded by greed would refuse to let a friend make a copy.
Large corporations, of course, are blinded by greed. The laws under which they operate require it — their shareholders would revolt at anything less. And the politicians they have bought off back them, passing laws giving them the exclusive power to decide who can make copies.
There is no justice in following unjust laws. It’s time to come into the light and, in the grand tradition of civil disobedience, declare our opposition to this private theft of public culture.
We need to take information, wherever it is stored, make our copies and share them with the world. We need to take stuff that’s out of copyright and add it to the archive. We need to buy secret databases and put them on the Web. We need to download scientific journals and upload them to file sharing networks. We need to fight for Guerilla Open Access.
With enough of us, around the world, we’ll not just send a strong message opposing the privatization of knowledge — we’ll make it a thing of the past. Will you join us?
Aaron Swartz
July 2008, Eremo, Italy
—–
You were the best of us; may you yet bring out the best in us.
-Anonymous, Jan 13, 2013.
—-
(Postscript: We tender apologies to the administrators at MIT for this temporary use of their websites. We understand that it is a time of soul-searching for all those within this great institution as much — perhaps for some involved even more so — than it is for the greater internet community. We do not consign blame or responsibility upon MIT for what has happened, but call for all those feel heavy-hearted in their proximity to this awful loss to acknowledge instead the responsibility they have — that we all have — to build and safeguard a future that would make Aaron proud, and honour the ideals and dedication that burnt so brightly within him by embodying them in thought and word and action..."


VOGH Reaction:- There is nothing much to say, we are speechless after what happened. Swartz suicide is surely a defeat of freedom. Last but not least VOGH team along with the whole cyber world will miss Aaron Swartz, RIP!


-Source (TC & Wired)






SHARE OUR NEWS DIRECTLY ON SOCIAL NETWORKS:-

Master Card Blog Hacked & defaced By Syrian Electronic Army

Master Card Payments Perspectives Blog Hacked & defaced By Syrian Electronic Army

It's became a very common scenario that hackers targets banks, payment gateway and other financial sectors. Sites like Paypal, Visa, Master Card were among those common victims who used to face massive round of cyber attacks. Past two years hacktivist managed to interrupt the service of those websites many times. Here also in the beginning of 2013 almost same situation took place, when the official blog of Master Card get hacked and defaced.  It was the Saturday evening when a hackers collective group named "Syrian Electronic Army" managed to breach and get access inside Master Card blog. I am sure that all our readers will be shocked after hearing the way of intrusion. In the platform of the blog, Master Card was using an older version of WordPress (Ver. 3.3.2) which has several critical vulnerabilities like XSS, file uploading, CSRF and so on. Exploiting those loopholes the hacker managed to get access inside the blog and defaced one of the page of the giant in international financial services company's blog. Though WordPress have released a security patch and also version 3.5, but it's quite unfortunate and shocking that Master Card did not even patched their older version for which their system get penetrated. It is truly unbelievable that sites like Master Card is so careless about basic security and counter measure of cyber attack. According to sources Syrian Electronic Army used  the CSRF exploit of WordPress which is said to be available on the Internet and allows an attacker to add a new administration user. This is a possible explanation of how the Syrian Electronic Army managed to hack and deface the blog. After this incident occurs Master Card immediately updated the version of WP and closed those back doors. Still the the defaced and cached version of the  blog can be viewed on Google’s Web Cache







SHARE OUR NEWS DIRECTLY ON SOCIAL NETWORKS:-

Yahoo Mail Hit By XSS Exploit Putting 400 Million Users At Risk

Yahoo Mail Hit By XSS Exploit Putting 400 Million Users At Risk

Yet again mistrust growing in between the large number of Yahoo users, as it has been continuously failed to protect its customers from cyber attack. Late in last year we have seen that the two major services of Yahoo get compromised, which affects millions of its registered users across the globe. First it was Yahoo Voice, which get hacked while putting 450K users at high risk. Then it was the time for Yahoo Mail, where few Egyptian hacker figured out serious XSS vulnerabilities in Yahoo Mailing service  that lets attackers steal cookies from Yahoo Webmail users. Later cyber criminals made product while exploring that loop holes, that so called product or widely known as exploit was made available at high price in underground market and forums. As expected Yahoo immediately patched these loopholes, but now it seems they did not learn lesson from the decent past. 
You all may be wondering! what happened? Again the security of Yahoo fallen victim in front of hackers.  Shahin Ramezany, a hacker and independent security researcher have figure out a DOM-Based XSS vulnerability in Yahoo Mail that is exploitable in all major browsers. Ramezany tweeted about this issue whihc links to an YouTube video, where he demonstrated the hack. Shahin Ramezany also claimed that the exploit have put more than 400 Million yahoo users at risk


As soon as this story get spotted, Yahoo immediately responds the matter, in their official release a Yahoo spokesman said "We’ve been looking into it and the US have now confirmed that they are investigating too. They will be in touch if there is a comment – otherwise I recommend that if users are concerned then they should change their passwords immediately." 

Later Yahoo said that thy have plugged the security hole. In their statement the spokesperson added, “At Yahoo! we take security very seriously and invest heavily in measures to protect our users and their data. We were recently informed of an online video that demonstrated a vulnerability. We confirm that the vulnerability has been fixed. In addition, we are investigating recent reports of increased abusive traffic and will work diligently to fix any vulnerabilities that are found. Concerned users are encouraged to change their passwords to a safe password that combines letters, numbers, and symbols.”

But this issue did not get completely resolved, as immediately after the fix release of Yahoo, Shahin Ramezany said that the fix is not good enough, and the Yahoo Mail exploit is still active. In his twitter he said "not effective enough and users are still [at] risk," since the proof-of-concept code can be easily tweaked to continue attacks. 





SHARE OUR NEWS DIRECTLY ON SOCIAL NETWORKS:-

Related Posts Plugin for WordPress, Blogger...