Alerts This Week
Warning Icon 1 792
Alerts This Week
Warning Icon 1 792

Linux Hacks & Cracks - Page 80

We have thousands of posts on a wide variety of open source and security topics, conveniently organized for searching or just browsing.

Authorities have dismantled SocksEscort, a service that sold access to a large proxy network built from compromised residential routers. Investigators say much of the infrastructure sat on infected SOHO networking devices, many running embedded Linux...

We’ve been telling ourselves that Snap apps are sandbox...

UNC2891 has been working its way through gaps in ATM se...

Discover Hacks/Cracks News

LS Hmepg 337x500 34 Esm H267

Inside MPAA: Insights from a Hacker's Experience in the Industry

data:image/svg+xml,%3Csvg%20xmlns=%22http://www.w3.org/2000/svg%22%20viewBox=%220%200%20100%20100%22%3E%3C/svg%3E

In an exclusive interview with Wired News, gun-for-hire hacker Robert Anderson tells for the first time how the Motion Picture Association of America promised him money and power if he provided confidential information on TorrentSpy, a popular BitTorrent search site. Read on for an account of Hollywood-style hacker plots - big bad company hires young hacker to obtain vital information, hacker uses savvy to accomplish goal, +1 to the lore of hack0rz. In actuality, the "hack" was nothing more than a weak password, and the retrieval of the "vital information" was nothing more than some reconfigurations of email forwarding. I think the most interesting (and important) aspect of this act was the fact that the hacker-for-hire "knew the network very well", showing once again that these types of attacks are almost always 90% or more planned out rather than improvised. -1 to Hollywood "I can hack anything anytime" lore. How do you feel about the MPAA's tactics?

LS Hmepg 337x500 34 Esm H267

Defense Strategies For Corporate Storage Systems Against Cyber Threats

data:image/svg+xml,%3Csvg%20xmlns=%22http://www.w3.org/2000/svg%22%20viewBox=%220%200%20100%20100%22%3E%3C/svg%3E

Corporate storage systems and networks are an attractive target for hackers looking to steal sensitive data or launch computer attacks, Alan Lustiger, security architect at TD Ameritrade, told an audience at Computerworld's Storage Networking World user conference in Dallas Monday Looks like NAS systems are becoming the low-hanging fruit as far as hackable network storage. The article states that the systems are most attractive due to its reliance on well-known protocols, and that these protocols could easily be studied and picked apart. This just sounds to me like a poor use of security - certain protocols have been around longer than the cast of Cocoon (ok maybe not THAT long) and yet many open-source companies maintain and secure them daily. Read on and let us know how you would defend "well known clear protocols"!

LS Hmepg 337x500 34 Esm H267

Investigating Firefox Add-ons for Effective Web Security Testing

data:image/svg+xml,%3Csvg%20xmlns=%22http://www.w3.org/2000/svg%22%20viewBox=%220%200%20100%20100%22%3E%3C/svg%3E

I wrote about three of my favorite Firefox extensions that help me stay safe when I'm browsing the darker areas of the Web and incoming email. Today, let's look at three other extensions: Those that can turn Firefox into a feature-filled, Web-hacking weapon. These extensions aren't required to use Firefox for hacking Web applications, but they certainly make it a lot easier. Should web servers be alarmed about this attack? Maybe web administrators should start using these Firefox extensions to test out how secure their web pages really are.

LS Hmepg 337x500 34 Esm H267

Exploring VMWare DHCP Server Flaws and Virtualization Security Risks

data:image/svg+xml,%3Csvg%20xmlns=%22http://www.w3.org/2000/svg%22%20viewBox=%220%200%20100%20100%22%3E%3C/svg%3E

Flaws in your DHCP server that allow intruders access to your whole system are not exactly what people have in mind in secure systems. Such flaws have been discovered in VMWare and are definitely worth taking a look at. Read on to see the ups and downs of VMWare in open source security - what do you think has to be done before virtual servers will be taken into the mainstream for enterprise companies?

LS Hmepg 337x500 34 Esm H267

Exploring Adaptation Trends of Storm Worms in Cyber Threats

data:image/svg+xml,%3Csvg%20xmlns=%22http://www.w3.org/2000/svg%22%20viewBox=%220%200%20100%20100%22%3E%3C/svg%3E

Musicians are constantly reinventing themselves in an attempt to "keep up with the times" - noone wants to be that oldies band / artist. Malware and worms do the same, this time through emailing sensationalist headlines that are too juicy to not click on. Read on for a quick overview of how worms have no vacations as well as an interesting point about these new attacks trends - they keep up with our time to stay relevant. Even the message bodies are conformed to 2007!

LS Hmepg 337x500 34 Esm H267

Intranet Security Risks: Analyzing Browser Attacks and Their Trends

data:image/svg+xml,%3Csvg%20xmlns=%22http://www.w3.org/2000/svg%22%20viewBox=%220%200%20100%20100%22%3E%3C/svg%3E

Robert Hansen provides us a very intriguing paper on web application security by focusing on the attacks on intranets through web browsers. This is not to say that all servers will be vulnerable to the attacks described in the paper, rather that the web servers act as a proxy to enable certain forms of probing and attacks. Read on for a more detailed account of an increasing trend of internet hacks.

LS Hmepg 337x500 34 Esm H267

Understanding Storm Botnet's Role in Recent Social Engineering Attacks

data:image/svg+xml,%3Csvg%20xmlns=%22http://www.w3.org/2000/svg%22%20viewBox=%220%200%20100%20100%22%3E%3C/svg%3E

Even with the latest layers of security in spam and virus filtering, there is still the threat of social engineering attacks that lay waste to the best security systems possible. Enter the latest Botnet attacks, this time using YouTube and "confirmation spam" as bait for unsuspecting users to infect their systems. In the world of social networking and Web 2.0 where everything "just works", how do you reach users who still believe that Windows is the internets and explain to them what social engineering is?

LS Hmepg 337x500 34 Esm H267

1.6M Records Stolen: Monster.com Identity Theft Incident

data:image/svg+xml,%3Csvg%20xmlns=%22http://www.w3.org/2000/svg%22%20viewBox=%220%200%20100%20100%22%3E%3C/svg%3E

Everyone wants to make sure their financial institution is secure - the bank has security cameras, their websites use the strongest encryption algorithms, the works. What do you do when another store of your own personal wealth is compromised? What if this store of wealth is your very own identity along with your entire history of accomplishments? Read on to find out why security just isn't for "banks and money" and such - the very place people invest their hopes and dreams in gaining a better career is at risk.

LS Hmepg 337x500 34 Esm H267

New E-Mail Attack: Automatic Installations Bypassing Antivirus Alerts

data:image/svg+xml,%3Csvg%20xmlns=%22http://www.w3.org/2000/svg%22%20viewBox=%220%200%20100%20100%22%3E%3C/svg%3E

Avinti, a developer of proactive e-mail security solutions, has issued a security alert about a new e-mail attack that disguises malicious code behind a seemingly harmless e-greeting. Is this just another one of theses attacks which tries to trick users in downloading a virus? What I found interesting that the articles states that theses types of emails should not be considered Spam. What do you think? This also brings up the question should spam filter's try to block theses emails or is it the responsibly of anti-virus software?

LS Hmepg 337x500 34 Esm H267

UN Website Under Attack: SQL Injection Incident Overview

data:image/svg+xml,%3Csvg%20xmlns=%22http://www.w3.org/2000/svg%22%20viewBox=%220%200%20100%20100%22%3E%3C/svg%3E

This just shouldn't be happening, no matter your side of the political fence. Last Sunday resulted in the UN website being publicly defaced with political messages from the hackers. I'm saying this shouldn't be happening because the attackers used an SQL injection attack against a reported "very common vulnerability". These types of attacks are "fairly easy to avoid and very surprising to find in such a high profile site". No matter what wing we fall under, security specialists should always fall under the role of doing your job, and making sure common holes like these are patched and secured.

LS Hmepg 337x500 34 Esm H267

Robert Moore’s $1 Million VoIP Heist Using Brute-Force Attacks

data:image/svg+xml,%3Csvg%20xmlns=%22http://www.w3.org/2000/svg%22%20viewBox=%220%200%20100%20100%22%3E%3C/svg%3E

Robert Moore, a 23-year old hacker from Washington, summarizes his $1 million heist of VoIP minutes. His methods involved brute-force attacks against Cisco XM routers and Quintum Tenor voice gateways in order to gain access and route calls through them. Just to clarify (FTA) - the attacks could easily have been prevented if the default passwords were changed on the routers. Even so, read on to find out how he confused the intrusion detection systems, how he gained the address to attack, and how he knew which attacks to send to which ports.

LS Hmepg 337x500 34 Esm H267

Exploring Bug Bounties: Strategies Against Zero-Day Exploits

data:image/svg+xml,%3Csvg%20xmlns=%22http://www.w3.org/2000/svg%22%20viewBox=%220%200%20100%20100%22%3E%3C/svg%3E

This article brings up two interesting questions - should vendors place bounties on zero-day exploits in order to get a jump ahead in developing the signatures for the attacks? What if these signatures could be reversed-engineered to create an even deadlier exploit? Read on for a look into the cat and mouse chase of security vendors attempting to gain the upper hand on shutting down zero-day attacks, only to have their defense used against them. How do you feel about bug bounties?

LS Hmepg 337x500 34 Esm H267

DefCon: Key Lock Issues Affecting White House and Pentagon Security

data:image/svg+xml,%3Csvg%20xmlns=%22http://www.w3.org/2000/svg%22%20viewBox=%220%200%20100%20100%22%3E%3C/svg%3E

"If you can't physically protect your computer, you are screwed," said Zac Franken, a hacker who engineered a way to outwit door locks relying on key cards. A security research from DefCon recently reported on several major vulnerabilities in some key locks used by not only home and businesses, but by the White House and Pentagon as well. Franken brings up a very obvious but often overlooked point - people leave computers on at night thinking that the building they're in is secure, but this is not the case. Read on to find out what steps Franken has taken in his attempt to report his claims.

LS Hmepg 337x500 34 Esm H267

VoIP Security Insights: H.323 and IAX Protocol Exploits Explained

data:image/svg+xml,%3Csvg%20xmlns=%22http://www.w3.org/2000/svg%22%20viewBox=%220%200%20100%20100%22%3E%3C/svg%3E

Sec Partners has detailed half a dozen ways to hack into VoIP phone systems that use the H.323 and Inter Asterisk eXchange protocols. Himanshu Dwivedi, principal partner at iSec, and Zane Lackey, security analyst there, also released exploit tools to back up their claims about the weaknesses in H.323 and IAX. Does this prove that we need to start thinking about VoIP security more seriously? I know I don't think about it much. Maybe the VoIP software will have to starting using security technologies like encryption or authentication. What do you think will help improve VoIP security?

LS Hmepg 337x500 34 Esm H267

Black Hat 2007: An In-Depth Review of Forensics Tools Testing

data:image/svg+xml,%3Csvg%20xmlns=%22http://www.w3.org/2000/svg%22%20viewBox=%220%200%20100%20100%22%3E%3C/svg%3E

Take two popular forensics tools (Sleuth Kit and Encase) and hammer and fuzz the hell out of them. What do you get? Read on to see a recap of a Black Hat Conference session as the writer gives you the results of the tests. I also enjoyed his few choice lines at the end concerning proper overall etiquette (hackers are human, after all ... most of us at least)...

LS Hmepg 337x500 34 Esm H267

Social Engineering: The Perfect Attack on Security Systems

data:image/svg+xml,%3Csvg%20xmlns=%22http://www.w3.org/2000/svg%22%20viewBox=%220%200%20100%20100%22%3E%3C/svg%3E

"A socially engineered e-mail, which contains a Trojan file that exploits a zero-day vulnerability and then hides behind a rootkit, might be the perfect attack and impossible to defend against." It made me think is socially engineered hacks the perfect hack? Is fooling users considered the perfect hack? I feel finding a security vulnerability in software and using that vulnerability in a attack should be considered in a perfect attack.

LS Hmepg 337x500 34 Esm H267

IE and Firefox Vulnerability: Remote Code Execution Threat Overview

data:image/svg+xml,%3Csvg%20xmlns=%22http://www.w3.org/2000/svg%22%20viewBox=%220%200%20100%20100%22%3E%3C/svg%3E

" The vulnerability, which was widely reported on security blogs, allows an attacker to remotely execute malicious code on a machine that is running IE but also has the Mozilla browser installed." I found this hack to be interesting because how the hack uses both IE and Firefox. Who's at fault? Is it IE for allowing the hack to open a Firefox browser or is it a Firefox flaw, in that it allows execution of the code?

Your message here