Tuesday, March 25, 2014

Microsoft Word Is Under A Hack Attack: Do Not Open Documents Named '.RTF'


Computer hackerMicrosoft Corp. on Monday issued an emergency security warning saying that hackers have found a way to booby-trap certain common Word files with the .rtf extension.Microsoft says it's aware of attacks going on now, but there's no fix yet to stop the hackers. It's working on a way to stop the bug.

The only way to be sure your computer won't get infected is not to open a document with the .rtf file extension until Microsoft says it's fine to do so.
This is the worst kind of attack. A hacker who manages to get you to open a booby-trapped file can gain control of your computer. From there, the hacker can do all kinds of things. For instance, the hacker can turn your computer into a so-called zombie by putting it on an illegal botnet. That means hackers can use your computer as part of a bigger network of computers to do all kinds of illegal things — like send spam, spread viruses, and commit fraud.
Even scarier is that the hack could work in preview mode. That's where you don't actually open the file but view it in an email instead. Outlook, for instance, lets you preview attachments.
Microsoft is recommending that you block all .rtf documents from your computer. It released a free tool that will set that up for you.
While .rtf files are not the default for Microsoft Word — the default is .docx or .doc — this is not a strange or unusual type of document. RTF stands for rich text format. For example, it's the default file format used by TextEdit, the free word-processing app that comes with Macs.
If people tend to email you a lot of Word documents, and you don't want to block all .rtf documents, another good choice is to set up your email to be in text mode, recommends security blogger Paul Ducklin via the Sophos security blog. The downside: This can make formatted emails, like newsletters, more difficult to read.

Monday, March 17, 2014

‘Password’ is the password: Feds easy target for hackers despite billions spent

 Joe Raedle/Getty Images/AFP

Government agencies in the United States are often failing to implement even the most basic deterrents that would boost their cybersecurity efforts, a new Senate report found.
According to the report – authored by Senator Tom Coburn (R-Okla.) and staff members at the Homeland Security and Governmental Affairs Committee – numerous federal agencies are leaving themselves open to cyberattacks simply by declining to fix simple, straightforward network problems.
The new findings surfaced despite the fact that the United States has boosted spending on cybsersecurity. Roughly $65 billion has been spent on securing computers and networks since 2006, the survey stated, but agencies “continue to leave themselves vulnerable, often by failing to take the most basic steps towards securing their systems and information.” One disturbing example was the lack of strong passwords in the government networks; a common key code was simply the word “password.”
Deficiencies in federal systems spanned multiple agencies, including those housing sensitive information such as the Nuclear Regulatory Commission, the Securities and Exchange Commission, and the Internal Revenue Service.
Even the Department of Homeland Security, which is responsible for supervising the security of all unclassified federal networks, is apparently lacking in its preparation. The report found “hundreds of vulnerabilities” on its systems, including “failures to update basic software [anti-virus programs, Microsoft Office, etc.]...the sort of basic security measure just about any American with a computer has performed.”
“None of the other agencies want to listen to Homeland Security when they aren’t taking care of their own systems,” Coburn, the ranking Republican on the committee that drafted the report, told The Washington Post. “They aren’t even doing the simple stuff.”
Some security breaches have been chalked up to pranks, such as last year’s hack that used the Emergency Broadcast System to air messages warning of zombie attacks in Michigan, Montana, and North Dakota.
Others have been more serious. A year ago, hackers stole a database of information regarding the United States’ 85,000 dams, including the “potential for fatalities if breached.” Meanwhile, the report found the Nuclear Regulatory Commission routinely stored security information for nuclear plants on a shared, unprotected drive. The SEC risked disaster as well, exposing sensitive information about the stock market’s systems and security.
In addition to these cases, more than 48,000 other “incidents” involving federal systems were reported to the DHS in the 2012 fiscal year. To make matters even more worrying, federal tests found that civilian agencies don’t detect about 40 percent of intrusions into their networks.
In the face of the Senate report, the White House acknowledged there’s still more work to be done in order for federal agencies to secure their networks.
“Almost every agency faces a cybersecurity challenge,” Michael Daniel, special assistant to the president on cybersecurity policy, said to the Post. “Some are farther along than others in driving awareness of it. It often depends on whether they’ve been in the crosshairs of a major cyber incident.”
Over the course of the past year, US officials have warned that cyberattacks now constitute the number one security threat to the country, and that China in particular has been responsible for a new digital offensive. In a particularly troubling case for the US, Chinese hackers were able to access sensitive information regarding some of the country’s most sophisticated weaponry.
China, for its part, adamantly denies the accusations. It claims to have “mountains of data” detailing attacks from the United States, and regards the US itself as the leading digital hacker.

Wednesday, March 12, 2014

Happy Birthday Internet! World Wide Web Turns 25

http://theconnectivist-img.s3.amazonaws.com/wp-content/uploads/2014/03/4507546591.jpg
 
(CNN) – It was 1993 when David Wood got his first look at the World Wide Web.

Working as a consultant for the city of Palo Alto, California, in the epicenter of the dotcom universe, some researchers pulled up a Web page created by the Vatican, showcasing some of its artwork.

“The Web pages back then had that gray and black text and embedded images. There was no fancy layout; it was very simplistic,” he said.

“But it was powerful. I said, ‘My God, this is it. This is what’s going to define the next phase of my life.’ It was a quite powerful, transformative concept.”

It’s hard for some of us to imagine now. But before broadband and YouTube, before instant streaming and overnight deliveries from Amazon, the early Web was a slow, simple and sparsely populated place.

As the Web turns 25 this week, folks who remember those early days have been reminiscing about life online in the early to mid-1990s. One word that comes up over and over again? “Slow.”

A 1995 survey by the Pew Research Center found that just 14% of U.S. adults had Internet access, and among them, only 2% had access via a top-of-the-line 28.8k modem.

“That was screaming (fast),” said Lee Rainey, the director of Pew’s Internet Project. “Now, that would make people riot in the streets, it’s so slow.”

Wood, now chief technology officer with linked-data company 3 Round Stones, would go on to a career on the Web and to author several books about it. But in the early to mid-’90s, it wasn’t always an easy sell.

“When I would show people the Web on dial-up, you’d whip out a laptop and dial up with a 14.4k modem,” he said. “The page might take a minute or two or three or five to come down. You could see the hasher lines coming across from left to right as the page would slowly load.
“People would look at this and say, ‘Why is this interesting?’ “

Invented by Tim Berners-Lee, the Web made accessing the Internet (no, they’re not the same thing) easier for millions.

“The really early users were total geeks,” Rainey said. “They had to know coding. They had to know sophisticated prompts to get information from different places. They had to tell their computers so they would know exactly where to go.”

That started changing as folks started opening their mailboxes and finding discs from Web-portal services like AOL, Compuserve and Prodigy. But even that more-accessible Internet was a far cry from what we know today.

“It was mostly a text experience that was dominated, to some degree, by websites of major publishers who were just trying to use this new platform to essentially replicate what they already had,” Rainey said. “CNN.com was basically what was on television. The New York Times was basically what was in the paper.”

Take a look at early versions of some of today’s most popular websites, and the contrast is stark. Now, the homepage for the White House features an elegant design that incorporates hundreds of links to videos, photo galleries, podcasts and other media. In 1996, the same URL took you to a stretched-out glob of black text on a plain white background, topped by the oh-so-catchy headline “Search White House Press Releases, Radio Addresses, Photos and Web Pages.”

Go to Yahoo today, and you can scroll through a 95-image gallery of links to news stories, choose from a list of links to trending topics, check on your stocks or jump straight to Yahoo-owned services like Tumblr and Flickr.

Time warp to 1996, and there’s not a photo to be seen. Yahoo’s homepage featured little more than a pile of hyperlinks that left half the page blank.

Oh, and that movie you streamed last night? Or the song it took you 20 seconds to download from iTunes or Google Play? Few Web users were even dreaming about them.

“If you had a music player or other streaming device, it was very scratchy,” Rainey said. “Words were interrupted. There were lots of hiccups in the server. But people lived with that because it was kind of exciting to have it happening in the first place.”

Wood concurs. For Web pioneers, and those who followed soon behind, experimenting with its emerging capabilities was, in part, its own reward.

“It’s like coffee culture versus tea culture,” he said. “With coffee, you’re gulping it down, trying to get your caffeine. Tea culture is more sipping and experiencing the taste.

“We had a sipping culture back then, and now we have a gulping culture. That’s the big change. It was a small number of geeks who were tasting this concept for the first time. We were getting little bits. We were tasting them, and we were saying, ‘How could this change the world?’ “


Tuesday, March 11, 2014

iOS 7.1 Kills Evasi0n7 Jailbreak Tool While Apple Gives Credit To Evad3rs For Key Security Changes

Apple-iOS7.1
Jailbreak users are recommended not to update their devices to the new iOS 7.1 if they want keep their jailbreak unharmed. Reuters
Apple’s (NASDAQ:AAPL) latest iOS 7.1 firmware update patched evasi0n7, the untethered jailbreak tool that was released to jailbreak devices running on iOS 7, while the company also gave credit to evad3rs -- the jailbreakers’ team that created evasi0n7 -- for some significant security changes introduced in iOS 7.1.
ADVERTISEMENT
Following the release of the iOS 7.1 on Monday, reports began appearing on the Internet claiming that the latest iOS version has killed all the exploits that were used by the hackers to develop evasi0n7 to perform an untethered jailbreak on iOS 7 devices. According to the reports, jailbreak users should not update their devices to the new iOS 7.1 if they want to keep their jailbreak unharmed.
MuscleNerd, a renowned iOS hacker and jailbreak developer, also recommended the same for his followers on Twitter.

 

Currently, there is no indication from evad3rs that evasi0n7 will be updated to support iOS 7.1.
Meanwhile, Apple has updated the support web page on its website with a newly created document, which describes multiple iOS 7.1 security changes and improvements. In the document, the company gave credit to evad3rs members for reporting issues and helping Apple implement four key changes to the iOS 7.1 firmware.
The first improvement deals with a bug, which allowed a maliciously crafted backup to alter the iOS file system in devices, including the iPhone 4 and later, iPod touch (5th generation) and later, iPad 2 and later.
The second security change was related to a crash-reporting issue, which could allow a local user to change permissions on arbitrary files on the affected devices.
The third security concern dealt with a kernel issue that could allow for an unexpected system termination or arbitrary code execution in the kernel itself, which goes into the making of jailbreaks. Here is how Apple described the issue:
An out of bounds memory access issue existed in the ARM ptmx_get_ioctl function. This issue was addressed through improved bounds checking.
The remaining security issue was related to a bug, which could enable an unauthorized user to bypass code-signing requirements on the affected devices.
In addition, Apple also credited Stefan Esser, another iOS hacker, for a bug that could enable an attacker to entice a user into downloading a malicious app via Enterprise App Download.
Apple has thanked iOS hackers for their exploits in the past as well. In 2012, the company gave credit to the iOS Jailbreak Dream Team for discovering a kernel exploit that was patched in iOS 5.1. After the release of iOS 6.1.3 in March 2013, Apple thanked evad3rs for helping it fix four bugs, iDownloadBlog reported.

Wednesday, March 5, 2014

Latest Google Hacking Entries


http://burstlimit.in/wp-content/uploads/2013/07/wpid-dorks.png



 Latest Google Hacking Entries


Date Title Category
2014-02-28 intitle:Admin inurl:login.php site:.co.in Pages containing login portals
2014-02-05 intitle:not accepted inurl:"union+select"... Various Online Devices
2014-02-05 allinurl:"zimbra/?zinitmode=http" -googl... Pages containing login portals
2014-02-05 intext:"Access denied for" intitle:"... Error Messages
2014-02-05 allinurl:/hide_my_wp= Sensitive Directories
2014-02-05 inurl:"/reports/rwservlet" intext:"... Vulnerable Servers
2014-02-05 intitle:"pChart 2.x - examples" intext:&... Advisories and Vulnerabilities
2014-02-05 "[function.getimagesize]: failed to open stre... Error Messages
2014-02-05 site:bitbucket.org inurl:.bash_history Files containing juicy info
2014-01-03 allinurl:"/main/auth/profile.php" -githu... Pages containing login portals

Vietnamese blogger jailed for two years for 'abusing democratic freedoms'

A Vietnamese blogger, Truong Duy Nhat, has been sentenced to two years in prison on a charge of "abusing democratic freedoms to infringe on the interests of the state and on the legitimate rights and interests or organisations and citizens."
Nhat, 50, who lives in the central city of Danang, insisted on his innocence throughout his trial. He acknowledged posting content critical of the authorities but denied that it violated any law.
He has been under detention since his arrest in May 2013. He used to work for various state-controlled newspapers – including the police paper, Bao Cong An Quang Nam Danang – until launching his blog, "Another point of view," in 2011.
Benjamin Ismaïl, of the press freedom watchdog, Reporters Without Borders, said: "We are outraged by the continuing persecution of bloggers. Like Le Quoc Quan, whose jail term was upheld two weeks ago, Nhat is being jailed for his commitment to Vietnam's right to an alternative to the information provided by the state propaganda machine.
"We demand the release of Nhat and all the other detained bloggers, who are guilty solely of promoting freedom of information in Vietnam."
Sources: RSF/Washington Times. To sign the petition calling for the release of 35 Vietnamese bloggers go here