Time Warner Cable Support Service Hacked and Defaced by NullCrew 

Time Warner Cable Inc has had its main website for its cable service hacked and left defaced with its embarrassing administration password.

The attack has been carried out by members of NullCrew who have announced it on twitter and posted a screen capture to freezepage

The main target was TimeWarnerCable.com online support service administration area which is running on port 8888 for web access.

Null Crew members Orbit and Doc gained access via a exploit found in the systems ASP which allowed them further access to be able to escalate user permissions and as a result they found out the administration had an account with the password set as “changeme” which is just shocking to say the least.

The attack has also exposed what is said to be one of the systems SSL key passwords.

The website was also defaced with a dump of information and partial configuration files from the server and at time of publishing the websites defacement was still active via port 8888 which is the administration access.

In recent weeks we have seen more and more high profile targets come under attack by hackers who have left them shamed for lack of security on systems they use.

Gang arrested for hacking Dh7 million from Dubai exchange companies accounts

Gang arrested for hacking Dh7 million from Dubai exchange companies accounts

The Dubai Police have arrested a cyber crime gang who were able to transfer more than Dh7 million from exchange companies in Dubai. Abdul Hamid, a Pakistani heavy machinery dealer, said the hacker intercepted his UK suppliers’ emailed invoices for orders worth about £65,000 (Dh358,882). “I was stunned. The hacker had been stalking me online, waiting until I reached a price agreement with the supplier. He then sent me fake invoices and emails posing as the supplier, so he could get the money instead.” he said. According to police a gang of Asians and Africans work with hackers in order to enter different websites and systems of different companies here in Dubai in order to transfer money inside and outside the country.

61 Year Old Hacker found guilty in Corporate Hacking case by FBI

61 Year Old Hacker found guilty in Corporate Hacking case by FBI

(img is for fun)

A 61 years old Texas man 'Michael Musacchio' found guilty of conspiring to hack into his former employer's computer network by FBI this week.  According to the evidence submitted at trial, from 2002 to 2004, Musacchio was the president of Exel Transportation Services, a third party logistics or inter modal transportation company that facilitated links between shippers and common carriers in the manufacturing, retail, and consumer industries. Between 2004 and 2006, Musacchio along with fellow Exel employees Joseph Roy Brown and John Michael Kelly hack into Exel's computer system for the purpose of conducting corporate espionage.

Pakistan Intelligence agency hacked by Indian hacker

Pakistan Intelligence agency hacked by Indian hacker

While the rest of the world engaged in cyber security conferences and Anonymous operations, an Indian patriotic hacker used the time to attack Pakistan Intelligence agency ISI.

Hacker going by name "Godzilla" today claimed to hack into one of the server belongs to ISI website (http://isi.org.pk) and gets all possible secret information about Pakistan Intelligence.

According to the information shared by hacker with 'The Hacker News', he claims to have access to Remote Desktop Protocol (RDP) of the server located at 173.193.110.72.

He disclose that System installed with Windows 2008 server standard edition and having three derives i.e C,D,E with operating system in C and Hostname 'AHCORP'

He also claimed to hack into MSSQL server containing 3 databases, with 9 users and located at http://mssql.isi.org.pk, as shown in screenshot taken by him.

Some partial tables of the database 'msdb' as listed below:

• bakupfile
• bakupmediafile
• bakupmediaset
• backupset
• logmarkhistory
• restorefile
• restorehistory
• suspect_pages

Hacker also share the login credentials of the RDP, but because of the sensitive hacking scene, we preferred to not disclose further information. 

Chinese search engine Baidu launches free Antivirus Suite

Chinese search engine Baidu launches free Antivirus Suite

Chinese search engine Baidu has just launched a security product called Baidu Antivirus 2013. Described as a ultra light weight, easy to use, extremely fast anti-virus program that promises to protect your system from malware, viruses, spyware, adware and other malicious programs.

Most interesting thing is that Baidu Antivirus comes only in English. Back in January, Baidu launched Baidu PC Faster, a software suite designed to fix speed and performance issues.

The program combines the Baidu Antivirus Engine and Baidu Cloud Security Engine with the Avira Antivirus engine to provide you with complete protection against all online threats.

"Baidu Antivirus offers an easy to use interface with several advanced configuration options as well as quarantine of infected files. It also has an extremely small memory footprint, so you can actually do other things while it is running on your computer. Other features include automatic updates, Host Intrusion Prevention System (HIPS), scan reports and more." description reads.

You can download Baidu Antivirus 2013 here and please note that, its a Chinese product, so use at your own risk !

Snort 2.9.4.1 - Network intrusion detection system

Snort 2.9.4.1 - Network intrusion detection system

Snort is a free and open source network intrusion prevention system (NIPS) and network intrusion detection system (NIDS) . Snort having the ability to perform real-time traffic analysis and packet logging on Internet Protocol (IP) networks. Snort performs protocol analysis, content searching, and content matching.

The program can also be used to detect probes or attacks, including, but not limited to, operating system fingerprinting attempts, common gateway interface, buffer overflows, server message block probes, and stealth port scans. Snort can be configured in three main modes: sniffer, packet logger, and network intrusion detection.

Improvements in Snort 2.9.4.1

• Updated File processing for partial HTTP content and MIME attachments.
• Addition of new config option max_attribute_services_per_host and improve memory usage within attribute table.
• Handle excessive overlaps in frag3.
• Stream API updates to return session key for a session.
• Reduce false positives for TCP window slam events.
• Updates to provide better encoding for TCP packets generated for respond and react.
• Disable non-Ethernet decoders by default for performance reasons. If needed, use --enable-non-ether-decoders with configure.

Download Snort 2.9.4.1

Philippines-Malaysia Cyber war over Sabah land dispute

Philippines-Malaysia Cyber war over Sabah land dispute

A series of websites defacement has been conducted between Philippines and Malaysia over the dispute in the land of Sabah. Hackers claiming to be part of Anonymous group from Malaysian and Filipino and attacking websites of each other.

 It was believed that the first online attacks were made by Malaysians and defaced the government-owned site of the municipality Moal Boal, Cebu, hours after a skirmish erupted between police and Sulu gunmen on Friday.

Meanwhile the online shop of Philippine mobile services provider Globe Telecom was defaced by hackers claiming to be from the "MALAYSIA Cyb3r 4rmy".

 On other side Philippine Cyber Army hackers claiming to have attacked 175 Malaysia-based sites,“Greetings Malaysia! Greetings Government! Stop attacking over our cyberspace or else we will attack your cyber world!” the Philippine hackers.

Today story take another angle, when Several websites of Philippine local governments have been hacked by the so called “Anonymous Malaysia” 3rd group of hackers with the message: “Well, its time for us to PEACE and stop attacking each other. To end up this way, this is our last defacement and from now on none of us will step or touch ur (sic) country site and none of you are able to touch our country site. If u against (sic) this agreement, we wont accept any apology or excuses #wewillnotgodown.”

A statement by hacktivist group Anonymous on pastebin also called for hackers of both countries to stop. "The petty cyber-war will gain us nothing but wrong impressions from ordinary people. Our goal is to peacefully unite the collective consciousness of humanity. We urge our brothers from both countries to sit and talk  Not blabber out words then fight like kids. We have no place for petty arguments and to surrender to provocative actions that we know we can answer with a larger and bolder approach."

As far now, Individual hackers from both parties are appeared to have started the attacks on each other.

HTML5 browser exploit can flood your Hard Drive with junk data

HTML5 browser exploit can flood your Hard Drive with junk data

Feross Aboukhadijeh, 22-year-old Web developer from Stanford has discovered HTML5 browser exploit can flood your Hard Drive with Cat and Dogs i.e junk data.

Many times a website needs to leave a little data i.e 5-10KB on your computer like a cookie, but HTML5 allow sites to store larger amounts of data (like 5-10 MB). In a proof-of-concept he was able to full up 1 GB of HDD space every 16 seconds.

He created FillDisk.com in order to demonstrate the exploit in HTML5. Once user will visit the website the Web Storage standard allows website to place large amounts of data on your drive. Please note that, It's not a hack and this exploit won't allow attackers to access your computer.

However, Web browsers have the ability to limit just how much space websites can dump onto your hard drive. Firefox's implementation of HTML5 local storage is not vulnerable to this exploit. Whereas Chrome, Safari (iOS and desktop), and IE vulnerable to this.

You can find the source code here. Feross already logged the bug for Chrome and Safari, so the problem there should be fixed soon.

Jailed cyber criminal hacked into prison computer system from Jail

Jailed cyber criminal hacked into prison computer system from Jail

Old habits seem to die hard for a hacker, a cyber criminal who masterminded a £15 million fraud was allowed to join a prison IT class and hacked into the jail’s computer system.

Nicholas Webber, serving five years in prison for running an internet crime forum Ghost Market, Which allowed those interested in creating computer viruses, partaking of stolen IDs and enjoying private credit card data to congregate.

Webber had been arrested for using fraudulent credit card details to pay for a penthouse suite at the Hilton Hotel in Park Lane, Central London.

The incident occurred back in 2011, but it only came to light recently "At the time of this incident in 2011 the educational computer system at HMP Isis was a closed network. No access to personal information or wider access to the internet or other prison systems would have been possible," A spokesman fοr prison tοƖԁ the Daily Mail reported.

His IT teacher, Michael Fox ,who was employed by Kensington and Chelsea College has now brought a claim for unfair dismissal, saying that it wasn't his fault that Webber ended up in his class. Fox also says he had no idea Webber was a hacker. While the college cleared Fox of committing security breaches, he was made redundant when no alternative work could be found for him.

The hack at the prison triggered a security scare during a lesson but it was not immediately clear what information he managed to access.

Old School Hackers spying on European governments

Old School Hackers spying on European governments

Kaspersky Lab's team of experts recently published a new research report that analyzed that Cyber criminals have targeted government officials in more than 20 countries, including Ireland and Romania with a new piece of malware called 'MiniDuke'.

In a recent attack, malware has infected government computers this week in an attempt to steal geopolitical intelligence. The computers were infected via a modified Adobe PDF email attachment, and the perpetrators were operating from servers based in Panama and Turkey.

According to Kaspersky Lab CEO Eugene Kaspersky,"I remember this style of malicious programming from the end of the 1990s and the beginning of the 2000s. I wonder if these types of malware writers, who have been in hibernation for more than a decade, have suddenly awoken and joined the sophisticated group of threat actors active in the cyber world."

Last week Adobe released an update that patches the Adobe PDF bug (CVE-2013-6040) used in the attack. Once it was opened, the MiniDuke malware would install itself on a victim's computer. It is not known what information the attackers are targeting.

MiniDuke attacks government entities in Belgium, Brazil, Bulgaria, Czech Republic, Georgia, Germany, Hungary, Ireland, Israel, Japan, Latvia, Lebanon, Lithuania, Montenegro, Portugal, Romania, Russian Federation, Slovenia, Spain, Turkey, Ukraine, United Kingdom and United States.

The malware also compromised the computers of a prominent research foundation in Hungary, two thinktanks, and an unnamed healthcare provider in the US.

Tunisian Cyber Army Spree of Attacks on Financial Sites...

Last month a hacker using the handle @TN_cyberarmy who goes by the team or group name of Tunisian Cyber Army had been on a small spree of attacks on financial based websites.
The attacks range from a bank in America to two master card websites being exposed as having XSS exploits in them which are still live weeks later.

First there was 6 small data breaches on some bank based websites which had been posted and announced together

Then the centralebank.com got its database breached and was posted and dumped on and announced via twitter. the site also appears to be offline now and the leaked data has been confirmed as real.

The XSS attacks have been on a master card and American express website, one which i already reported on here and the other is smartpaymastercard.com

 

The attacks have been carried out in the name of #opBlackSummer which is said to really kick off in the coming months but its unsure exactly what will be in target.
bank list:

1. http://www.thefriendlybank.com/
2. http://www.pashupatibank.com/
3. http://www.bankcap.com/
4. http://www.nbbl.com.np/
5. http://www.nbk.cn/

lulzsec.com Sub domain hacked or was it

 lulzsec.com Sub domain hacked or was it 

Updated: Sub domain has been taken over by the FBI, see below..

Today i was alerted to a hack by a group of old school hackers from the late 90′s who have left a sub domain of the well known hacker collective lulzsec hacked.

The attack appears to be a DNS attack as well as a defacement on another site which is currently sharing the same IP (74.220.210.192) that the “defaced” sub domain is currently being hosted on. the main lulzsec website with or without the www shows the the long existing notice that has been taken over by authorities.

The attack has been done by Prime Suspectz who on Zone-h have not made a post to the site since 2005, but that does not mean they have been totally quite over this period. The defacement has a message to lulzsec and anonymous and makes mention of sabu, stating that they remember a older conversation from back in 2004 where he couldn’t hack.

Prime Suspectz & core-project is back!

x-s4nd3r / st4ck / eCORE / coolswallow

LulzSec owned?

 Anonymous & LulzSec are the world’s biggest lamerz, they think leaking can make them big haxor? no, you are wrong! u will be never big hacker, ur the biggest lamers of this planet..people like you destroy the hacking scene, you use LOIC and thinking ur big hacker, hahahahaha!

 we are not dead, big lamerz like u must be destroyed, also for sabu (the police snitch), you were the biggest n00b i ever talked to in 2004, using lame ssh exploits u could not even pwn a IE2-box, do not believe the media!! media delivering false news…sabu was the biggest n00b of this century, and nobody gives a fuck about ur lame leakz, anonymous 

 but the show is not finished yet, we are not dead…we always watching u 

The other website which shares the same IP as the portal.lulzsec.com currently does is http://pekingporkchop.com/ and that is also displaying the same defacement page leaving one to think that is the main defacement as it shows up in caches as a old unused Joomla  website with no content.

So, lets break this down a bit to see what is going on. The main lulzsec site is owned by FBI, a sub domain has been hijack either by DNS hijack or hackers have control to a cname controller some how and now the site is pointing to another site name pekingporkchop.

Proof that both were on different IP’s at time of publishing.

See a Mirror of the defacement: here and the rest of prime suspects older defacements here

Reverse IP on 74.220.210.192

Also like to make the note of timing of this breach, within weeks of news coming out that sabu has been giving more time away from sentencing to assist police further which has put a lot of anger and upset many people in the community as people who sabu helped get arrested are facing big time behind bars.

So ill leave you to figure out what the hell exactly happened here, so have fun oh and Credit goes to @agd_scorp for alerting me to this.

Updated:

Once again @agd_scorp has alerted me to the sub domain now also being in control of the FBI as well as the other site which appeared to have the deface http://pekingporkchop.com/,

This makes one wonder if the site has actually been seized or was all this just a big hoax of some sort or has the FBI gone and seized another site now due to defacement? make note of the mxtoolbox.com results below which show at time of update all ips were still the same as first publish.

Once again, ill leave you to think about this one. bu

MVS comunicaciones Hacked, 1,700+ Credentials leaked 

A Mexican based Telecommunications company who runs various sub company’s has been breached and as a result the credentials of its administration and service users have been leaked.

The company is MVS Comunicaciones (http://www.mvs.com) runs pay television services and is based in mexico.

MVS Comunicaciones (MVS) is a Mexicanmedia conglomerate. The company owns MASTV, MVS Radio operator of four national radio networks, MVS Televisión operator and distributor of 7 pay television networks, E-Go wireless broadband internet and 51% of Dish México.

The leak was announced on twitter by hacker using the handle @MexicanH

The leaked data has been posted to pastebin and contains around about 3,000 accounts but many of them are duplicated or using same emails for different systems as there is a few different tables from the sites database, All together there is 1700 non duplicated accounts with emails.

All account credentials vary and some passwords appear to have full encryption while others are lacking this security.

Source: pastebin