Buffer Overflow vulnerability in Acunetix scanner allows to hack the noobs who attack your website

Danor Cohen, a Security researcher who recently discovered the 'WinRAR file spoofing vulnerability', has discovered one more zero day vulnerability.  This time it is Buffer Overflow vulnerability in one of the popular web application vulnerability scanner 'Acunetix'.

There is a feature in Acunetix that allows to scan the additional domains or subdomains detected during the scan.

"It learns about the external related domains from the external sources that appear at the scanned website, for example: "<a href=http://externalSource.com/ ></a>"

Danor found that if the 'external' source url's length is larger than 268Bytes, the Acunetix vulnerability scanner will get crashed.

For Ex:
 <A href= “http://AAAAAAAAAAAAAAAAAAAAAAAAAA...........AAAAA”>

Researcher managed to exploit this vulnerability and successfully launched an executable file(calc.exe). By modifiying the code, one can infect the computers of newbies with a malware who attempt to scan their websites.

More technical details are available at his blog post.

Here is Proof of concept video:

OpenSSL vulnerability allows hackers to read 64k of memory on target server


HeartBleed: A potentially critical security vulnerability in OpenSSL has been discovered that allows an attacker to read up to 64kilobytes of memory from the server running a vulnerable OpenSSL version.

As a normal user, you may not aware what is OpenSSL.  It is cryptographic library which is used for encrypting communication between web server and users - used by plenty of websites including Google, Yahoo, Twitter.

The bug( CVE-2014-0160), dubbed as 'HeartBleed', was independently discovered by Neel Mehta from Google Security team and Codenomicon.  The bug appropriately named HeartBleed because vulnerability is located in HeartBeat extension and it leads to memory leak.

The attacker can read only up to 64k of memory during one iteration of the attack.  However, according to Heardbleed.com, an attacker can "keep reconnecting or during an active TLS connection keep requesting arbitrary number of 64 kilobyte chunks of memory content until enough secrets are revealed".

An attacker can retrieve the private key used for encrypting the communication that will allow to read all information passed to server and user like it wasn't encrypted at all.

How to fix it?
If your server is using OpenSSL 1.0.1 and 1.0.1f, then better upgrade to 1.0.1g. If you are using 1.0.0 and 0.9.8, you are not vulnerable to this bug.  As a temporary fix, users can remove HeartBeat extension by recompiling OpenSSL with -DOPENSSL_NO_HEARTBEATS

Check whether Your server is vulnerable or not:
"http://filippo.io/Heartbleed/" allows to find whether your server is vulnerable to this bug or not.

Details about the Bug:
TLS Heartbeat extension is to ping from one end to another end - a specific message with size of it is being sent from client to server and server responds with the same message.

But, if an attacker send a small size of data(Let's say 1 kilo byte) and claims it's large size(64k), then the server(running vulnerable OpenSSL) will respond with 1 kilo byte of attacker's data + 63 kilobytes of data read from memory of the server.

Technical details of this bug can be found here .(read only if you are good in 'C' program).

Here is POC script written in Python: https://gist.github.com/ixs/10116537

*Update:
Metasploit Module :
https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/scanner/ssl/openssl_heartbleed.rb

Nessus Plugin:
http://www.tenable.com/plugins/index.php?view=single&id=73404

Nmap Script(NSE):
http://nmap.org/nsedoc/scripts/ssl-heartbleed.html

One should always be careful, when using pointers in C programming ;)

Germany's biggest data theft, 18 million emails and passwords stolen


18 Million email addresses and passwords have been stolen in what is being called the biggest data theft in Germany's history.

The compromised accounts are reportedly being misused for criminal purposes such as spreading spam emails.

The authorities have determined that at least three million of compromised accounts belong to German citizens(accounts ending with '.de').  The rest had international domain extensions such as '.com'.

It is still unknown exactly how many German and people from other countries have been affected by this massive data theft. 

A spokesperson for the states prosecutor's office in Verden, Lower Saxony, Germany, told The Local that they are currently in the process of determining how hackers accessed 18 million accounts.

It is second major data theft in Germany this year.  In January, German authorities announced that hackers accessed 16 million email addresses and passwords.

Spec's breach affects 550,000 customers

Texas liquor store Spec's says it experienced a cyber attack on its network  that exposed personal and financial information of more than a half million customers.

The company issued a statement saying the breach affects fewer than 5% of its total transactions.  Those who shopped at one of the 34 their affected stores were affected by this breach.

According to the statement, the attack began on October 31,2012 and may have continued through March 20 of this year.

The exposed information includes names, credit/debit card number, expiration date and card security code or check information including Bank account number, bank routing number, birth dates, driver's license number.

Spec's spokeswoman Jenifer Sarver told the Houston Chronicle that the breach affected "an estimated fewer than 550,000" customers and Spec's employees.

Spec's says it's working with United States Secret service in ongoing criminal investigation to arrest the attackers and taking steps to prevent future attacks.

Opening an email containing RTF in Outlook hands your computer to hackers

How many of you are using Microsoft Outlook in your office? Previewing or opening an email containing .RTF file in Microsoft Outlook will open a backdoor for remote hackers to access your machine.

Microsoft warned today that attackers are exploiting a new zero-day vulnerability in Microsoft Word that allows them to run arbitrary code in the vulnerable system.

"The vulnerability could allow remote code execution if a user opens a specially crafted RTF file using an affected version of Microsoft Word" Security advisory reads. "or previews or opens a specially crafted RTF email message in Microsoft Outlook while using Microsoft Word as the email viewer."

The vulnerability affects Microsoft word 2003, 2007,2010,2013, word viewer and Microsoft Office for Mac 2011.  Advisory states that the exploits it has seen so far have targeted Microsoft word 2010 users.

Microsoft is in the process of creating patch for this security flaw.  In the meantime, they have released a temporary Fix it solution which prevents opening of RTF files in Microsoft word.

Other suggestion to prevent yourself from being victim are 'configuring the outlook to read email messages in plain text format', 'using Enhanced Mitigation Experience Toolkit(EMET)'.

Syrian Electronic Army gather evidence that Microsoft selling your information to FBI

A document recently leaked by Syrian Electronic Army shows that Microsoft is charging FBI secret division to legally view customer information.  The documents are said to have been taken from Microsoft.

Syrian Electronic Army(SEA) is known for hacking social media accounts and websites of top organizations including Microsoft, CNN, Daily dot and more. 

SEA allowed the Daily Dot to analyze the documents before they published in full.

The document is said to be containing emails and invoices between Microsoft's Global Criminal Compliance team and the FBI's Digital Intercept Technology Unit (DITU).

The documents shows that Microsoft charged FBI $145,100 in December 2012, broken down to $100 per request for information.  But in 2013, Microsoft allegedly doubled the amount, charged FBI $200 per request for a total of $352,200.  For the recent invoice(Nov 2013), they charged $281,000.

The information provided to FBI including Live email ID, PUID, name, address, country, IP address, Date of Registration and few other details.

Here is the screenshot of documents:





Operation Windigo: Thousands of Linux and Unix Servers hacked to deliver malware, spam

Hackers compromised thousands of Linux and Unix servers and used them for stealing SSH credentials, sending millions of spam messages and infecting visitors with malware.

The campaign has been dubbed as Operation Windigo, which was uncovered by researchers at security firm ESET.

According to the report, the operation has been ongoing since 2011 and more than 25,000 servers have been compromised in the last two years. 

Even some of high profile servers including Cpanel and Kernel.org had been affected by this campaign.

Millions of users to legitimate website hosted on affected servers are being served with malware via exploit kits and 35 Million spam messages are being sent each day from the compromised servers.

Three main components used in this operation are:

  • Linux/Ebury – an OpenSSH backdoor used to keep control of the servers and steal credentials
  • Linux/Cdorked – an HTTP backdoor used to redirect web traffic. We also detail the infrastructure deployed to redirect traffic, including a modified DNS server used to resolve arbitrary IP addresses labeled as Linux/Onimiki
  • Perl/Calfbot – a Perl script used to send spam

Detailed technical paper on "Operation Windigo" is here.

25,000 cards data compromised in Sally Beauty data breach


Earlier this month, Krebs on Security first reported that one of the largest retailers of beauty products 'Sally Beauty' had been hacked.  At the time, the Sally Beauty said there is no card data involved in the breach.

Today, the company confirmed that its network has been breached and fewer than 25,000 credits cards data may have been compromised by attackers. 

“As experience has shown in prior data security incidents at other companies, it is difficult to ascertain with certainty the scope of a data security breach/incident prior to the completion of a comprehensive forensic investigation." Sally Beauty said.

"As a result, we will not speculate as to the scope or nature of the data security incident." the company added.

The company said they will continue to work with Verizon and US secret services on this investigation.  The company is taking necessary actions and precautions.

In the meantime, an unknown hacker defaced a website selling the stolen credit card data and send a message to the admin of the site as well as to Brian Krebs.

" Hi subhumans and miscreants, your fraud site is gone now. Go away.
Also, Krebs, please dont call me a punk on Twatter: im trying to be a good person :(" The defacement page reads.

"To all the people who used this service to blackmail and threaten and "dox" people's families: fuck you especially. To the "regular" fraudsters: fuck you too but slightly less.  To Cloudflare: why in a billion 6000-degree hells is your NS TTL 80000?" 

Miley Cyrus, Taylor Swift and Britney Spears websites hacked by Ethical Spectrum

Update :
The latest tweet from the hacker shows he compromised the database containing username and password details belong to these websites "The database of #MileyCyrus, #SelenaGomez......etc with 2,5 million users and pass is for sell, anyone interested email me at my mail"

Exclusive Information:
The hacker told E Hacking News that he found multiple vulnerabilities in the Groundctrl website and gained access to the database server.

He also gained access to the CMS panel which manages the celebrities' websites.
GroundCtrl CMS Panel

Original Article:

 
A hacker going by online handle "Ethical Spectrum" has hacked into websites belong to several celebrities and defaced the sites.

The affected websites include Miley Cyrus official site(mileycyrus.com), Selena Gomez(selenagomez.com), Taylor Swift site(taylorswift.com), Britney Spears site(britneyspears.com).

We are able to confirm that these are official websites of the celebrities, as it is being linked from their twitter account.

According to hackers twitter account(@Eth_Spectrum), he hacked into the above mentioned websites on March 8th.  The website was restored after the breach.  However, hacker mentioned he once again managed to deface them.  ]

Other websites attacked by the hacker are Ground Ctrl(groundctrl.com), mypinkfriday.com, Chelsea Handler site (chelseahandler.com), Aaron Lewis(aaronlewismusic.com/), therealcocojones.com, christinagrimmieofficial.com, Kacey Musgraves(kaceymusgraves.com).

The defacement just reads "Why i hacked this site, you can ask this person greg.patterson@groundctrl.com".

Greg Patterson is the co-founder of the Groundctrl, an organization that build websites for artists.  It appears the security breach started from Groundctrl.

Other affected sites:
  • Pat Green(patgreen.com),  
  • Rob Thomas(robthomasmusic.com), 
  • Rock Mafia(rockmafia.com  ), 
  • ritawilson.com  , 
  • sum41.com
  • nickcarter.net
  • jordanknight.com
If you are not able to see the defacement, you can find the mirror here:
http://www.zone-h.org/archive/notifier=Ethical%20Spectrum

All of the affected websites are currently showing the maintenance error message except groundctrl official website.

Hacker didn't provide much information about the breach, so we are not sure how exactly he hacked into all of these websites, whether he found a zero-day exploit on the cms developed by groundctrl or all of the affected sites managed in a central place. 


Hackers compromise 300,000 SOHO routers and changed DNS to redirect to attacker site

A security researchers at Team Cymru have uncovered a Pharming attack campaign targeting Small office and Home office(SOHO) routers.  So far, more than 300k SOHO routers have been compromised.

The hackers altered DNS settings  to use IP addresses '5.45.75[.]11' and '5.45.75[.]36' on the compromised devices in an effort to redirect the victim to attacker's website.

Most of the compromised devices are from Vietnam.  India is also to be one of the top countries affected by this campaign.  Other affected countries are including Italy, Thailand, Indonesia, Ukraine, Turkey, Colombia.

The affected routers are from number of manufacturers including Micronet, Tenda, D-Link, TP-Link.  Researchers say that affected devices are vulnerable to multiple exploits including CSRF attack, vulnerability in ZyXEL firmware.

The vulnerability in ZyXEL's ZynOS was discovered by researcher back in January which allows attacker to directly download the routers configuration file http://[IP Address]/rom-0.

So far, the attackers didn't seem to have abused the compromised devices.  But, the attack is similar to the attack against a number of Poland's banks.  In which, the attacker changed the DNS configuration in order to steal Online Banking login credentials.

EC Council official website hacked


A hacker who calls himself "Eugene Belford" (A character from the movie "Hackers" )has hacked the EC-Council website - an organization that offers Certified Ethical Hacker(CEH)

"Owned by certified unethical software security professional" The defacement message reads.

He has also put in the deface page documents proving that "Edward Snowden" attended the CEH classes in India.

A spokesman from CSPF (Cyber Security and Privacy Foundation) says, it appears to be hackers used DNS hijacking attack to deface the website and possible gain access to their email.

Another CEH certified professional says he was not satisfied with EC Coucil  Training. He says though the course material is good and certification is recognised worldwide, the trainers from francisees of EC Coucil do not know hacking and they are not competent to take CEH classes.


Update: Sometime after this news was posted the hacker edited the deface page with this extra text. 

"Defaced again? Yep, good job reusing your passwords morons jack67834#

owned by certified unethical software security professional
Obligatory link: http://attrition.org/errata/charlatan/ec-council/
-Eugene Belford

P.S It seems like lots of you are missing the point here, I'm sitting on thousands of passports belonging to LE (and .mil) officials "

It might be that the attacker has gotten access to the emails of EC Council and hence all the email correspondence of the Law Enforcements and Military officials might be compromised also.



Syrian Electronic Army hacks Forbes website and twitter accounts

Forbes, american business magazine, is appeared to be the latest victim of the Syrian Electronic Army.  The group has managed to post articles entitled "hacked by syrian electronic army".

The group is experts in phishing attack -targeting employees of the organization with a fake emails.  We believe hackers used the same method for compromising Forbes' employees also.

It appears they have gained admin access to the wordpress panel that allowed them to post stories.

The group appears to have compromised one twitter account of forbes (@forbestech) and two twitter accounts(@thealexknapp, @samsharf) belong to their employees.  At the time of writing, Samantha sharf account still shows the hackers tweet.

The hackers said the reason for hacking forbes is because the publication posted  many articles against syrian electronic army, with muchnhate for syria.

400Gbps NTP-based DDOS attack hits CloudFlare - largest DDOS attack in History

Until a week ago, it was believed that Distributed denial-of-service(DDOS) attack against Spamhaus is the largest one in the history.  Now, an even bigger DDOS attack has been recorded by the Content delivery Network CloudFlare.

Matthew Prince, CloudFlare CEO, said in twitter that very big NTP reflection attack was hitting them and appears to be bigger than the Spamhaus attack from last year.

According to Matthew, the attack reached 400Gbps which is 100Gbps higher than the ddos attack targeting Spamhaus. 

CloudFlare said all websites have returned to production.

Founder of a French hosting firm OVH also said their network received more than 350Gbps traffic, but it is not clear whether it is related or not.

Last month, CloudFlare also wrote an article detailing about the Network Time protocol(NTP) based DDOS attacks that caused trouble for some gaming web sites and service providers.

NTP protocol is UDP-based protocol runs on port 123 which is used by Internet connected computers to set clocks accurately.  A system will synchronize with the server and receives the current time.

Experts says this protocol is prone to amplification attacks because it will response to the packets with spoofed source IP address "and because at least one of its built in commands will send a long reply to a short request. That makes it ideal as a DDoS tool."

List of open NTP servers on the Internet allows attackers to launch Denial of attack against any target network. 

JackPos, a new Point of Sale malware stole thousands of Credit card data

Cyber criminals keep targeting Point of Sale(POS) with malware in an effort to steal credit card data.  A new malware targeting POS have been uncovered security researchers.

According to the cyber intelligence firm IntelCrawler, the new POS malware dubbed as "JackPos" which is being distributed through drive-by download attack disguise itself as Java Standard Edition binary, replaces the legitimate Java Update Scheduler file in the infected system. 

The loaders used in the "Drive-by" download attack has been written in obfuscated and compiled AutoIt Script.  Researcher says it is a technique to avoid AV detection and unpack additional malicious codes that will receive instructions from C&C server.

"The Cybercriminals have used some sophisticated scanning, loading, and propagating techniques to attack these vectors to look to get into the merchants system through external perimeters and then move to card processing areas, which were possibly not separated in compliance with PCI polices."IntelCrawler said.


At least 4,000 credit card data appeared to be stolen from several countries.  The list of target countries including Canada, Brazil, India, France, Spain, United states, Argentina, Korea and others.

According to Globe and Mail, more than 400 card data have been stolen from Bangalore City, India. 3,000 cards' data stolen from Sao Paulo, Brazil.  700 cards data from Canada, 230 cards data from Madrid have also been compromised.

Facebook almost got hacked by Syrian Electronic Army, MarkMonitor website Hacked

Earlier today the Syrian Electronic Army posted a tweet with screenshots which suggested they had hijacked the Facebook's domain and changed the Registrant details and name server.

"Happy Birthday Mark! http://Facebook.com  owned by #SEA http://whois.domaintools.com/facebook.com" Hackers said in a tweet.

How hackers take control of Facebook Domain?
The next tweet confirmed that the hacker group took control of the MarkMonitor website - a website that manages Top Level domains including Facebook, Google, Yahoo and more.

The group managed to gain the admin panel of the Mark Monitor website that allowed them to access records of all domains hosted.


After learning about the breach, the Markmonitor immediately took down the Management portal.

It seems like facebook is lucky this time.  Even though the group changed the nameserver of the domain, it didn't reflect.  It's failed attempt to compromise domain's DNS records.  If they had managed to change the records successfully, it could have affected millions of facebook users.

Few other screenshots provided by Syrian Electronic Army shows that the group had access to Google, Yahoo and Amazon domains.




Ebay and Paypal UK domains hacked by Syrian Electronic Army

Paypal is the latest Organization to be victim of Syrian Electronic Army(SEA).  Today, the group has hacked into the MakrMonitor account managing the Ebay and Paypal domains.

Exclusive :MarkMonitor account of Ebay

SEA managed to modify the DNS records of ebay.co.uk and paypal.co.uk and left them defaced.

"For denying Syrian citizens the ability to purchase online products, Paypal was hacked by SEA" The group said in a tweet.

The group said it is purely a hacktivist operation and no user accounts or data affected by this breach.

"If your Paypal account is down for a few minutes, think about Syrians who were denied online payments for more than 3 years. #SEA"

Syrian Electronic Army is best known for its Spear Phishing attacks where employees of organization are targeted with malicious emails. It appears the group used the same attack to compromise the Mark Monitor account of Ebay.

Exclusive: Ebay defaced
The group also hacked the email account Paul Whitted, Sr. Manager, Site Engineering Center at eBay and posted screenshot of the internal communications.


Update:

"We’re aware our UK & France marketing pages were redirected briefly for a few users. Situation is resolved; NO customer info was compromised"Paypal has acknowledged the breach on its official twitter account.

Third-party database compromise leads to Yahoo mail account hack

Yahoo has acknowledged a number of yahoo mail accounts have been accessed by hackers.  Yahoo says the unauthorized access came after hackers compromise a third-party database.

Yahoo didn't specify the name of the third-party and didn't disclose number of affected users.  After learned about the unauthorized access, Yahoo is sending password reset mail to all impacted accounts.

The company also said in its official statement that they have found no evidence that the credentials were compromised directly from its server.  Their investigation revealed a malicious software is using the login credentials to access Yahoo mail accounts.

The company said that it is now working with federal law enforcement to find the cause of the unauthorized access.  Additional measures also implemented to secure its server.

Yahoo says if your account is affected by this breach, you will get a notification through your yahoo email or SMS if a phone number is linked to your account.

First Android Bootkit virus found to have infected 350,000 mobile devices

A New Android Trojan which is said to be the first Android Bootkit has been discovered by the Russian security firm Doctor Web.

The malware resides in the memory of the infected devices and launches itself early on in the OS loading stage and makes it hard to remove from the device.

The trojan, identified as Android.Oldboot.1.origin, installs one of its components into the boot partition of the file system.  It also modifies the init script -  a specialized program for initializing elements of the Android system.

When the device is turned on, the script is get executed and installs other malware components as a typical application.

Android virus which can't be removed by your Antivirus:  
This malware is considered as most dangerous of android malware because even if you remove it, once the device is rebooted, the component residing in the protected memory area will re-infect the device.

Researchers believe the threat gets into the device when user reflash their smartphones with the modified firmware containing this Trojan.

The malware has reportedly been infected more than 350,000 mobile devices around.  92% of the infected devices are appeared to be from China.

To prevent yourself from being victim to such kind of threats, make sure that you are not installing firmware from unreliable sources.  Users are also advised not to buy devices from unknown origin.

Exclusive: BCCI official website hacked by Bangladesh Grey Hat Hackers



A hacker named as "Ashik Iqbal Chy", from Bangladeshi Grey Hat hackers group hacked into the official website of Board Of Control For Cricket In India(BCCI.tv).

The hacker managed to publish and edit few articles with title "HackeD By AshiK IqbaL Chy" in the news section of the site.  Links to edited articles have also been displayed in the main page.

Hacker also changed the picture of the site with Bangladeshi cricket players with a short message saying " Don't mess up with Tigers!"

Hacker told EHN that he gained access to the admin panel of the website and managed to delete articles from the site which results in "under maintanence" mode.

Hacker told EHN that he managed to deface the home page also last night.  He provide us a screenshot of the admin panel.

Exclusive: Admin panel of BCCI

At the time of writing, the website is under "maintenance" mode.  Here is the list of mirrors of defacements:
http://www.zone-h.com/mirror/id/21650626
http://www.zone-h.com/mirror/id/21650812

Reason for the Hack:
One of the member of the hacker group told E Hacking News the hack is part of a protest against "India, England and Australia proposal on test cricket placed to the International Cricket Council"

CNN Twitter account and blog hacked by Syrian Electronic Army


Fake article posted by Syrian electronic Army

Just few hours ago, Syrian Electronic Army hijacked the official twitter account of CNN and started to posted series of tweets.

Hackers mentioned the hack is part of retaliation against CNN for "viciously lying reporting aimed at prolonging the suffering in #Syria."

"#CNN used its usual formula of present unverifiable information as truth, adopting a report by Qataris against #Syria." one of the tweets posted by hacker reads.

The group appears to have compromised the main twitter account @CNN and @natlsecuritycnn, main facebook page of CNN, CNN politics' facebook page.



"US Media strategy is now to hide the fact that the CIA controls and funds Al Qaeda by blaming #Syria instead for their terror. #SEA" Recent tweet from group reads.

The group also managed to compromise the "CNN Security Clearance", "Political Ticker", "The Lead", "The Situation Room" and "Crossfire" blogs.

The also managed to post a fake article entitled "BREAKING NEWS: US declares state of national emergency, State department reportedly out of reach"

  • http://security.blogs.cnn.com/2014/01/23/breaking-news-us-declares-state-of-national-emergency-state-department-reportedly-out-of-reach/
  • "China dumps all bonds, declares South China Sea closed zone ": http://politicalticker.blogs.cnn.com/2014/01/23/breaking-china-dumps-all-bonds-declares-south-china-sea-closed-zone/ 
  • http://situationroom.blogs.cnn.com/2014/01/23/breaking-china-dumps-all-bonds-declares-south-china-sea-closed-zone/


CNN confirmed the hack in their recent tweet saying " Some of our organization's social media accounts were compromised. We have secured those accounts and deleted unauthorized tweets."