Hacker site hacked again. This time famous black hat community, specialist in server rooting site dna-stuxnet.in got hacked by Shadow008 (Pak Cyber Army)
Hacked Site:-
http://www.dna-stuxnet.in/
Mirror Link:-
http://zone-h.com/mirror/id/14090295
Showing posts sorted by relevance for query Black Hat. Sort by date Show all posts
Showing posts sorted by relevance for query Black Hat. Sort by date Show all posts
dna-stuxnet.in hacked by shadow008
Hacker site hacked again. This time famous black hat community, specialist in server rooting site dna-stuxnet.in got hacked by Shadow008 (Pak Cyber Army)
Hacked Site:-
http://www.dna-stuxnet.in/
Mirror Link:-
http://zone-h.com/mirror/id/14090295
Metasploit declared $5,000.00, in 5 weeks for exploits Bug Bounty program
If you've got a way to crack Google Chrome, the Metasploit team wants to pay you for it. Today Rapid 7 announced that it has a total of $5000 in cash to reward to contributors who send in exploits for its Top 5 or Top 25 vulnerability lists. The exploits have to be submitted, and accepted, as modules under its standard Metasploit Framework license.
Cash for bugs is a controversial but common way for security firms to encourage hackers to send exploits to the white hats. As far as Bug Bounty programs go, Metasploit's program is meager. But for an open source program that relies on contributions sent in for free, it's an interesting experiment. The program will end quickly, lasting only five weeks (July 20). One fun thing that the team is doing is letting people stake a claim to their exploit of choice from their Top 5 (prize is $500) or Top 25 (prize is $100) lists. After claiming an exploit, hackers get a week to submit their Metasploit module for their chosen bug. The prize money will "only be paid out to the first module contributor for a given vulnerability," the Metasploit team says.
And guess what? Denial of Service exploits won't qualify. Metasploit wants your bug to be able to do more than that. It should also bypass ASLR/DEP when applicable and be geared toward English-based targets. Metasploit wants hackers to follow its hacking guidelines and they cannot be residents of a US embargoed country.
All accepted submissions will not only win a bit of cash but their submissions will be made available to other Metasploit users, again under the Metasploit Framework license (3-clause BSD).
As I look at the list of 30 possible exploits while writing this blog post, I see that only two have been claimed so far. CVE/ZDI 2011-1218, Lotus Notes - Autonomy Keyview(.zip attachment), and an exploit not listed in the CVE database, known as " DATAC RealWin On_FC_CONNECT_FCS_LOGIN packet containing a long username." So plenty of room for participants remains.
The cash-for-bugs program is interesting, but the list of vulnerabilities for which Metasploit is seeking help is even more so.
The Top 5 are for specific holes in ...
- Google Chrome (before 11.0.696.71)
- Lotus Note
- IBM Tivoli Directory Server
- DNS
- GDI
In the Top 25, the entries on the list that caught my eye include holes in JScript, VBScript Scripting Engines, JBOS, Oracle VM and Citrix, among others. (Yes, browsers are in there, too, including Firefox, Chrome and Opera).
Of course, if you do have a killer bug, particularly for some of the browsers like Firefox or Chrome you can perhaps earn more than $100 for it. Mozilla's Bug Bounty program pays up to $3000 cash reward and you get a Mozilla T-shirt. For web applications or services related security bugs, Mozilla pays from $500 to $3,000. In January, Google plunked out what was then a record reward, $3,133, to a hacker for reporting a flaw Chrome. (Google raised its bug bounty fee about a year ago, from $1,337 after Mozilla bumped up its reward rate to $3,000).
TippingPoint, known as one of the founders of the bug bounty concept, not only pays cash (as much as $5,000 for your zero-day), but it also awards bonus points in a scheme more complicated than an airline mileage rewards program. Participants earn points for referring others into the program, for each zero-day they submit and so on. These points gain you bonuses for your hacks, and other goodies like all-expense-paid trips to hacker conferences like Black Hat.
Who knew hacking could be so rewarding?
Indian Embassy Of Kathmandu, Nepal Hacked By Ghosts
Indian Embassy Of Kathmandu, Nepal Hacked By Ghosts (A Black Hat Team). They hacked into the database of the website and exposed sensitive information like admin details and many more.
Website:-
http://www.indianembassy.org.np/
user_name:- indianembassy
password:- 147f9d55b079a76d6ec6f36b61f4cf1a
full_name:- AdministratorLogin Link:-
http://www.indianembassy.org.np/admin/login.php
Ambassador Name:- Jayant Prasad
Amb_id :- 21
Last Modification:- 2011-08-27
For More Information Click Here
Bangladesh Cyber Army (BCA) Hit Indian Stock Market
Bangladesh Cyber Army (BCA) Hit Indian Stock Market (Cyber-War Continues)
The Cyber-War between India and Bangladesh is going on and on. But now its became rather one sided and most of the attack is coming from the Bangladeshi side. Recently they have released their second video where they vow to hit Indian Stock Market websites. During peak hour three main sites of Indian stock market was apparently down due to massive denial of service attack from BD hackers. As expected this DDoS attack surely effect the financial & banking sector of India.
Targeted Sites:-
The video mentioned the reason to be the killing another of innocent Bangladeshi citizens in the Bangladesh-India border zone yesterday. In the last 3-4 days, a huge number of Indian sites fell victim to hacking attacks of Bangladesh Cyber Army. Two other groups, Bangladesh Black Hat Hackers and 3xp1r3 Cyber Army were also involved in the attacks. Besides, they also have supports from Pakistani hackers which we have already covered. National Informatics Center (NIC), Indian Railways, Passport Dept, MIT, NDTV all became victim of this cyber attack.
VOGH Review:-
Being a media its our duty to rise awareness, so after seeing this so called cyber-war we can only see that it is just damaging thousands of websites. In short hackers from both countries are just bringing ruin to their own cyber space. While attacking websites of different countries, either knowingly or UN-knowingly they are just putting their cyber space in risk. Also such cyber-war always make negative reputation for those countries who have engaged the war. In short if they do not end war - the war will end them.
Serious Vulnerability Found By zSecure Team On The Web-Portal of Idea
A critical SQL-i vulnerability found on the web-portal of Ideacellular which can compromise the entire Database. This vulnerability has been found by zSecure Team. AS per the vulnerability analysis a smart black hat can exploit the entire DB, perform devastating attacks and also can get full access on their web-server.
Vulnerable Website:-
Vulnerability Type:-
Hidden SQL Injection Vulnerability
Database Type:-
MySql 5.0.27
Alert Level:-
Critical
Threats:-
Complete Database Access, Database Dump
Here are some Screen Shots to prove the Vulnerability:-
About Idea (Company Profile):-
Idea is the 3rd largest mobile services operator in India. Idea’s strong growth in the Indian telephony market comes from its deep penetration in the non-urban and rural markets. IDEA Cellular is an Aditya Birla Group Company, India’s first truly multinational corporation. The group operates in 26 countries, and is anchored by over 130,600 employees belonging to 40 nationalities. The Group has been adjudged the ‘6th Top Company for Leaders in Asia Pacific Region’ in 2009, in a survey conducted by Hewitt Associates, in partnership with The RBL Group, and Fortune. The Group has also been rated ‘The Best Employer in India and among the Top 20 in Asia’ by the Hewitt-Economic Times and Wall Street Journal Study 2007.
-News Source (Zsecure.net)
Colombiaweb Server Rooted More Than 2K Websites Hacked By Teamgreyhat (TGH)
Well known hacker group Teamgreyhat strikes again. In this attack they have rooted the colombiaweb's web server and thus they hacked into more than 2000 websites. TGH released a pastebin notes where they have mentioned all the hacked sites and their message. If you dig the decent past you will find out that TGH has already made their unique reputation on the web. This black-hat group is specially expert is rooting servers. Earlier they have rooted Mochahost Web Server, Guyana Server, Theexpert Server, Malaysian Web-host, Cybertek Web-Server, 5gbfree.com and many more. Also one of their big blow was that they have hacked the Hotmail mail servers. Again this 2000 sites hacking proves the capabilities of TGH.
Team Ghost Released Tax Records of Brazilian Govt, Exclusive Documents of #op-SouthAfrica & 10K SQL- Vulnerable Sites
Black Hat Ghost is back again with boom. Previously they exposed the secrete documents of DOD, NATO, NSA, DHS and many more. This time they exposed the entire tax record of Brazilian Govt. Also Team Ghost published a documents containing more than 10,000 SQL-i vulnerable sites and their details.
Not yet completed Team Ghost was running an operation named #opSouthAfrica and in this operation they have hacked into 50+ high profile websites of South-Africa including Govt. and so on.
According to The Official Press Release:-
Today I posted 3 Mediafire links
First link containing:
Tax records from www.balbinos.sp.gov.br From 2002-2011. I exposed everything they've purchased
in the last 9 years. ;)
Second link containing:
The whole contents of #opSouthAfrica, which was created by myself and involved hacking over 50 SouthAfrican websites, these were the main sites I targeted, and it shows Usernames, passwords, emails, Postal address's,databases,SQL Dumps and so on.
The third link of Tonights raids:
Contained 10,000+ SQL-i Vulnerable website links. Every one of these links was in-fact vulnerable at some point in time. So if a couple don't work now, then they've patched it.
These are just a taste of what's to come.
First link:
http://www.mediafire.com/?elm9kvaend2tk8y <--- Tax records
Second link:
http://www.mediafire.com/?nk69n6c5ufek8yk <--- #opSouthAfrica
Third link:
http://www.mediafire.com/?ryx7apfx6ohca7b <--- 10k+ Vulnerable Sites
Fore more info Click Here
SAP Will Patch Their Vulnerability Which Was Exposed By (Blackhat 2011 US)
A reportedly serious security bug affecting the J2EE (Java 2 Platform Enterprise Edition) engine in SAP's NetWeaver middleware will be patched soon, SAP said Friday.
NetWeaver underpins SAP's range of enterprise software, including its flagship Business Suite ERP (enterprise resource planning) product. The bug was discussed by security researcher and ERPScan CTO Alexander Polyakov during a presentation at the Black Hat security conference in Las Vegas on Thursday.
The vulnerability makes it possible to crack SAP systems over the Internet by circumventing authorization checks, Polyakov wrote in a blog post before the conference. "For example, it is possible to create a user and assign him to the administrators group using two unauthorized requests to the system."
The attack is also possible on systems that are protected by two-factor authentication systems that use both a secret key and password, he added. ERPscan is making a tool that can detect the problem available at no charge.
"SAP is working closely with Alexander Polyakov on this issue," SAP spokesman Andy Kendzie said in a statement Friday. "SAP will deliver a patch to its customers shortly."
The patch will come as part of a regular security update, and not an out-of-cycle emergency fix, he added.
The news comes shortly after Oracle's release of Java SE 7. The language update shipped with bugs that Oracle engineers knew about prior to the release, a move met with serious consternation from some critics. Oracle plans to fix the bug in an update.
NSA (National Security Agency) is Searching For Good Hackers
The National Security Agency has a challenge for hackers who think they’re hot stuff: Prove it by working on the “hardest problems on Earth.”
Computer hacker skills are in great demand in the U.S. government to fight the cyberwars that pose a growing national security threat — and they are in short supply.
For that reason an alphabet soup of federal agencies — DOD, DHS, NASA, NSA — are descending on Las Vegas this week for Defcon, an annual hacker convention where the $150 entrance fee is cash only — no registration, no credit cards, no names taken. Attendance is expected to top 10,000.
The NSA is among the keen suitors. The spy agency plays offence and defence in the cyberwars. It conducts electronic eavesdropping on adversaries, and it protects U.S. computer networks that hold super-secret material — a prime target for America’s enemies.
“Today it’s cyberwarriors that we’re looking for, not rocket scientists,” said Richard “Dickie” George, technical director of the NSA’s Information Assurance Directorate, the agency’s cyber-defense side.
“That’s the race that we’re in today. And we need the best and brightest to be ready to take on this cyberwarrior status,” he told Reuters in an interview.
The NSA is hiring about 1,500 people in the fiscal year, which ends Sept. 30, and another 1,500 next year, most of them cybersecurity experts. With a workforce of about 30,000, the Fort Meade-based NSA dwarfs other intelligence agencies, including the CIA.
It also engages in cyber-spying and other offensive operations, something it rarely, if ever, discusses publicly.
But at Defcon, the NSA and other “Feds” will be competing with corporations looking for hacking talent.
The NSA needs cybersecurity experts to harden networks, defend them with updates, do “penetration testing” to find security holes and watch for signs of cyberattacks.
The NSA is expanding its fold of hackers, but George said there is a shortage of those skills. “We are straining to hire the people that we need.”
It might seem to be an odd-couple fit — strait-laced government types with their rules and missions trying to recruit hackers who by definition want to defy authorities.
George said the NSA is an environment where the hacker mind-set fits with “a critical mass of people that are just like them.”
But what about culture rifts?
“When I walk down the hall there are people that I see every day and I never know what color their hair’s going to be,” George said. “And it’s a bonus if they’re wearing shoes. We’ve been in some sense a collection of geeks for a long, long time.”
The agency has long been known for its brilliant, but sometimes eccentric, mathematicians and linguists.
Jeff Moss, a hacker known as Dark Tangent, knows something about bridging the two worlds. He founded Defcon and the companion Black Hat conference for security professionals and is now a member of the Department of Homeland Security’s Advisory Council, which advises the government on cybersecurity.
“They need people with the hacker skill set, hacker mind-set. It’s not like you go to a hacker university and get blessed with a badge that says you’re a hacker. It’s a self-appointed label — you think like one or you don’t,” Moss told Reuters.
Computer hacker skills are in great demand in the U.S. government to fight the cyberwars that pose a growing national security threat — and they are in short supply.
For that reason an alphabet soup of federal agencies — DOD, DHS, NASA, NSA — are descending on Las Vegas this week for Defcon, an annual hacker convention where the $150 entrance fee is cash only — no registration, no credit cards, no names taken. Attendance is expected to top 10,000.
The NSA is among the keen suitors. The spy agency plays offence and defence in the cyberwars. It conducts electronic eavesdropping on adversaries, and it protects U.S. computer networks that hold super-secret material — a prime target for America’s enemies.
“Today it’s cyberwarriors that we’re looking for, not rocket scientists,” said Richard “Dickie” George, technical director of the NSA’s Information Assurance Directorate, the agency’s cyber-defense side.
“That’s the race that we’re in today. And we need the best and brightest to be ready to take on this cyberwarrior status,” he told Reuters in an interview.
The NSA is hiring about 1,500 people in the fiscal year, which ends Sept. 30, and another 1,500 next year, most of them cybersecurity experts. With a workforce of about 30,000, the Fort Meade-based NSA dwarfs other intelligence agencies, including the CIA.
It also engages in cyber-spying and other offensive operations, something it rarely, if ever, discusses publicly.
But at Defcon, the NSA and other “Feds” will be competing with corporations looking for hacking talent.
The NSA needs cybersecurity experts to harden networks, defend them with updates, do “penetration testing” to find security holes and watch for signs of cyberattacks.
The NSA is expanding its fold of hackers, but George said there is a shortage of those skills. “We are straining to hire the people that we need.”
It might seem to be an odd-couple fit — strait-laced government types with their rules and missions trying to recruit hackers who by definition want to defy authorities.
George said the NSA is an environment where the hacker mind-set fits with “a critical mass of people that are just like them.”
But what about culture rifts?
“When I walk down the hall there are people that I see every day and I never know what color their hair’s going to be,” George said. “And it’s a bonus if they’re wearing shoes. We’ve been in some sense a collection of geeks for a long, long time.”
The agency has long been known for its brilliant, but sometimes eccentric, mathematicians and linguists.
Jeff Moss, a hacker known as Dark Tangent, knows something about bridging the two worlds. He founded Defcon and the companion Black Hat conference for security professionals and is now a member of the Department of Homeland Security’s Advisory Council, which advises the government on cybersecurity.
“They need people with the hacker skill set, hacker mind-set. It’s not like you go to a hacker university and get blessed with a badge that says you’re a hacker. It’s a self-appointed label — you think like one or you don’t,” Moss told Reuters.
-News Source (Washington Post)
Serious Vulnerabilities Found By Deepanker Verma on Online Shopping Website
Serious Vulnerabilities Found By Deepanker Verma on shopping.indiatimes.com
Vulnerable Website:-
http://shopping.indiatimes.com/
According To the Hacker:-
"IndiaTimes shopping website has some serious XSS vulnerabilities which can lead to cookie stealing of users. And this may cause some serious loss to users. After going through some pages of the website, we (Shadab and me ) have found that the website is vulnerable to XSS injections and malicious scripts can be injected on the website."
Here are some screen shots submitted by the hacker to prove the vulnerability:-
XSS on the login Page
java-script Injection Vulnerability
Vulnerability on the product page
Cookie Stealing Vulnerability
iframe vulnerability
above screen shots are clearly saying that this website is truly vulnerable and has lots of loop holes, one black hat can also inject malicious codes and do marvellous harm
Twitter Hacked, More Than 250,000 User Data Compromised
Twitter Hacked, More Than 250,000 User Data Compromised
The social networking giant and the world famous micro blogging site Twitter again fallen victim of cyber attack. Last year we have seen that the tight security system if twitter have been compromised many times. Yet again in this year the San Francisco based social media giant who have more than 500 million registered users failed to protect them selves from hackers. On last Friday Twitter acknowledged that it had become the latest victim in a number of cyber-attacks against media companies, saying hackers may have gained access to information on 250,000 of its more than 200 million active users. The micro blogging giant said in a blog posting that earlier this week it detected attempts to gain access to its user data. It shut down one attack moments after it was detected. According to reports usernames, email addresses, session tokens and encrypted/salted passwords for 250,000 users might have been accessed in what it described as a “sophisticated attack”
"This attack was not the work of amateurs, and we do not believe it was an isolated incident,” said Bob Lord, Twitter’s director of information security. “The attackers were extremely sophisticated, and we believe other companies and organisations have also been recently similarly attacked” Bob added.
Jim Prosser, a Twitter spokesman, would not say how hackers infiltrated Twitter’s systems, but Twitter’s blog post said hackers had broken in through a well-publicized vulnerability in Oracle’s Java software. Last month, after a security researcher exposed a serious vulnerability in the software, though Oracle patched the security hole, but Homeland Security said the fix was not sufficient. The DHS issued a rare alert that warned users to disable Java on their computers. Prosser said Twitter was working with government and federal law enforcement to track down the source of the attacks. For now, he said the company had reset passwords for, and notified, every compromised user. The company encouraged users to practice good password hygiene, which typically means coming up with different passwords for different sites, and using long passwords that cannot be found in the dictionary.
Twitter said it “hashed” passwords — which involves mashing up users’ passwords with a mathematical algorithm — and “salted” those, meaning it appended random digits to the end of each hashed password to make it more difficult, but not impossible, for hackers to crack. Once cracked, passwords can be valuable on auction-like black market sites where a single password can fetch $20.
While talking about Twitter and cyber issues, I would like to remind you that in last year twitter faced several cyber attacks where more than 55,000 twitter account details was leaked, after this issue in the middle of last year the social networking giant faced massive denial of service which interrupted its services. Later a huge number of Twitter users across the globe received emails warning that their account have been compromised and their passwords had been reset, and it was another security breach which affected twitter. Such big organization are not at all careless about security, so as twitter and it has been proved when they hired renowned white hat hacker Charlie Miller to boost up their security, but after this current massacre, it seems that twitter need to think more and emphasize a lot to make sure that their system is good enough to prevent cyber attacks. For all the hot cyber updates and reviews stay tuned with VOGH.
Lulzsec & Anonymous jointly declared "Operation Anti-Security"
Lulzsec and Anonymous have just declared full open war against all governments, banks and big corporations in the world. They are calling all hackers in the world to unite. Their objective is to fully expose all corruption and dark secrets:
Salutations Lulz Lizards,
As we're aware, the government and whitehat security terrorists across the world continue to dominate and control our Internet ocean. Sitting pretty on cargo bays full of corrupt booty, they think it's acceptable to condition and enslave all vessels in sight. Our Lulz Lizard battle fleet is now declaring immediate and unremitting war on the freedom-snatching moderators of 2011.Welcome to Operation Anti-Security (#AntiSec) - we encourage any vessel, large or small, to open fire on any government or agency that crosses their path. We fully endorse the flaunting of the word "AntiSec" on any government website defacement or physical graffiti art. We encourage you to spread the word of AntiSec far and wide, for it will be remembered. To increase efforts, we are now teaming up with the Anonymous collective and all affiliated battleships.Whether you're sailing with us or against us, whether you hold past grudges or a burning desire to sink our lone ship, we invite you to join the rebellion. Together we can defend ourselves so that our privacy is not overrun by profiteering gluttons. Your hat can be white, gray or black, your skin and race are not important. If you're aware of the corruption, expose it now, in the name of Anti-Security.Top priority is to steal and leak any classified government information, including email spools and documentation. Prime targets are banks and other high-ranking establishments. If they try to censor our progress, we will obliterate the censor with cannonfire anointed with lizard blood.It's now or never. Come aboard, we're expecting you...History begins today.Lulz Security
This is not going to end well. Or perhaps it will end well. Could this movement help change the world for the better? With the growing worldwide discontent against the political and financial establishment—in my home country and all through Europe people are organizing to fight corrupted politicians and their greedy fat owners—I wonder if this may very well be the beginning of our May 1968. That was the time when the young French generations stood up against the government to demand a much needed change.
Opening the vaults of dark secrets and exposing corruption everywhere would certainly help towards that goal: Real change. Perhaps this is just the beginning of a quiet and angry revolution that will make the world a better place. Maybe making that information public will be instrumental to wake everyone up.
That said, exposing emails and private information from normal people or sinking ships that are neutral in this battle will not help towards that cause. That's not good and will not help anyone but those who they declare their enemies.
But uncovering the wrongdoings of states and economical institutions? I'm all for it.
