Items tagged with Hacking

There is a rash of complaints on Twitter over a recent Instagram hack that has left numerous users unable to access their accounts. Preliminary data suggests that the shenanigans originate from Russia, though nothing has been confirmed. Instagram is investigation the issue, and in the meantime, it has some advice for users. "If you received an email from us notifying you of a change in your email address, and you did not initiate this change— please click the link marked ‘revert this change’ in the email, and then change your password," Instagram advised in blog post. My instagram has been hacked! User name, password and email all been changed from some email address in Russia.... Read more...
If your laptop contains sensitive data, it is best not to leave it unattended. That is sound advice even it does not have any work secrets or other potentially compromising data, and you want to avoid falling prey to malware. In case you need a reason why, a security firm recently posted a video showing how quickly a hacker with physical access to someone's laptop can install malicious firmware onto the device. These types of security intrusions are called "evil maid" attacks, named after the scenario of someone breaking into a hotel room to physically access a target's notebook. Normally only the hotel's maid would go in and out of the hotel room, hence the clever "evil maid" designation. Of... Read more...
Every so often, WikiLeaks publishes top-secret documents outlining various hacking tools and malware used by the United States Central Intelligence Agency (CIA). Most of the documents we have seen are presumably outdated, but for obvious reasons, the CIA would still like to keep them under lock and key. The agency would also like to arrest the person responsible for providing the documents to Wikileaks, and has identified a possible suspect. That person is Joshua Adam Schulte, a former employee of a CIA group tasked with programming code to spy on foreign threats, The Washington Post reports. Federal prosecutors identified Schulte as a suspect during a hearing in January, noting that he provided... Read more...
MyEtherWallet confirmed on Twitter that hackers hijacked its Domain Name System (DNS) servers and redirected users to a phishing site in Russia. By obtaining private keys from affected users, the hackers reportedly were able to swipe around 215 Ethereum coins (ETH) worth somewhere in the neighborhood of $150,000. The attack lasted for several hours, and one user in particular lost more than 85 ETH worth almost $60,000. In the Twitter post, MyEtherWallet emphasized that the security breach did not take place on its side of the equation, and that it's currently in the process of verifying exactly which servers were hit so it can resolve the issue. In the meantime, MyEtherWallet is advising users... Read more...
Uber suffered a data breach back in October 2016 that affected tens of millions of people, and it is just now letting the public know about it, as 2018 rolls into view. This latest incident is yet another black eye for a company that has been beat up in the media over questionable decision making in the past, such as using special software to evade detection from authorities, but better late than never, right? To be fair, this is not th fault of Uber CEO Dara Khosrowshahi, who recently replace Travis Kalanick as the ridesharing company's boss. And to Khosrowshahi's credit, he responded to knowledge of the security breach with the fury of someone who wants to make it clear that this kind of thing... Read more...
Hacking happens all the time, and when it affects a large number of people, companies typically disclose the breach. Not always, of course, sometimes not even in a timely manner. As it pertains to Microsoft, something a little different occurred several years ago. Several former employees say a sophisticated hacking group busted into a secret internal database, which Microsoft never made public. Five ex-employees each told Rueters the same thing in separate interviews. All of them claim the breach happened in 2013, with Microsoft responding in private rather than disclosing the extent of the attack to the public or its customers. The database in question is said to have contained descriptions... Read more...
A security expert at Belgian university KU Leuven has discovered a major vulnerability in the Wi-Fi Protected Access II (WPA2) protocol that could a expose a user's wireless Internet traffic, including usernames and passwords that are entered into secure websites. The vulnerability affects most devices and several operating systems, including Android, iOS, Windows, Linux, and OpenBSD. "Attackers can use this novel attack technique to read information that was previously assumed to be safely encrypted," Marthy Vanhoef, a security expert at Belgian university KU Leuven, wrote in a detailed report (PDF) outlining the vulnerability. "This can be abused to steal sensitive information such as credit... Read more...
Late last year a hack was perpetrated on what is called a "partner organization" that worked with the Australian Signals Directorate (ASD). The unnamed organization notified the ASD that it was hacked in November of 2016, and that outside parties gained access to its network. The small organization has only 50 employees and is a subcontractor to the Department of Defense, providing aerospace engineering assistance. The data that was stolen in the hack contained information that is protected under the International Traffic in Arms Regulations (ITAR) and included details on the F-35 Lightning II fighter, P-8 Poseidon maritime patrol aircraft, C-130 transport aircraft, Joint Direct Attack Munition... Read more...
Do you know what hackers were doing around this time five years ago? They were breaking into a database at Disqus, the popular blog comment hosting service supported by scores of websites, in many cases in place of traditional web forums (remember those?). Disqus only found out about it this past Thursday and began alerting users a day later, rather than waiting like many companies often do. "On October 5th, we were alerted to a security breach that impacted a database from 2012. While we are still investigating the incident, we believe that it is best to share what we know now," Disqus stated in a blog post. "We know that a snapshot of our user database from 2012, including information dating... Read more...
The hype surrounding the upcoming Call of Duty: WWII is intriguing and very justified. Not much longer than a decade ago, it seemed the world was sick and tired of World War II-themed games, but thankfully, zombie games have since come to our rescue, cleansing our palettes. Today, WWII actually looks like it could give us a fresh experience, and create an interesting online battlefield. Unfortunately, "interesting" is proving true already, but not in a good way. Over the weekend, the beta for WWII went live, and almost immediately, complaints stemming from testers began to hit the web. In almost record time, those who find joy in ruining other persons' online experiences equipped themselves with... Read more...
Equifax is still trying to dig its way out from under the bad press and an angry public after a hack of its database gave access to personal information on 143 million Americans. Equifax offered those affected by the security breach the ability to lock their credit reports to prevent the stolen information leaked in the hack from being used to open new credit in their names. However, things just keep going from bad to worse for Equifax (and everyone in general). Equifax used a PIN that "protected" each user's credit report to prevent the information from being used, but the PINs were reportedly generated in such a way that they were left vulnerable to brute force hacking. Customers have found... Read more...
If you thought putting Homer Simpson in charge of a nuclear power plant seemed like a scary proposition, well, you would be right. But sometimes truth is stranger (and in this case, scarier) than fiction. Such is the case with security outfit Symantec reporting that hackers have been targeting the energy sector in Europe and North America since at least 2011. And if that's not frightening enough, they have kicked up their efforts in the past couple of years and even managed to breach companies that manage nuclear facilities in the United States. The group behind these attacks is known as Dragonfly. As part of the group's Dragonfly 2.0 cyber campaign, the hackers have been zeroing in on energy... Read more...
Would you trust your life to a hacker? No, of course not, and neither does the US Food and Drug Administration. The FDA issued a recall of nearly half a million pacemakers after the organization discovered a vulnerability that makes several models susceptible to hacking. Once exploited, a hacker would be able to control the device's pacing and deplete the batteries. "Many medical devices - including St. Jude Medical's implantable cardiac pacemakers—contain configurable embedded computer systems that can be vulnerable to cybersecurity intrusions and exploits. As medical devices become increasingly interconnected via the Internet, hospital networks, other medical devices, and smartphones, there... Read more...
Here we go again. WikiLeaks, the international non-profit whistleblower that publishes secret information to the web, has been dumping classified documents outlining various hacking tools and malware used by the United States Central Intelligence Agency. These documents are part of what WikiLeaks calls Vault 7, the latest of which contains information on the CIA's "CouchPotato" tool. According to WikiLeaks, CouchPotato is a remote tool for intercepting video streams as either an AVI video file or capturing still images of frames from the stream as JPEGs, presumably to save space. In the latter case, CouchPotato is able to analyze and detect when a frame of video is significantly different from... Read more...
A team of scientists from the University of Washington have figured out how to infect a computer using malicious code inside DNA. This attack vector isn't aimed at your everyday PC sitting on your desk at home or in the office; this hack aims directly at the infrastructure around the DNA transcription and analysis industry. The team behind the hack was concerned about the security with that infrastructure after finding basic vulnerabilities in some of the open-source software used in labs that analyze DNA all around the world. While the basic issues with the software could be vulnerable to hacks using traditional tools, like malware and viruses, the team of researchers went the extra... Read more...
For the past several months, WikiLeaks has been publishing information related to exploits and hacking tools that had been used by the United States government at some point. The project is known as Vault 7 and seems to contain mostly older exploits, though it is not clear if some of the malware has been updated for modern platforms. Not all of it is aimed at Windows. In fact, the latest documents reference macOS and Linux hacks that were part of the US Central Intelligence Agency's Imperial program.Image Source: Flickr (Tony Webster)The first of these is called Achilles. According to the documentation, it is a capability that gives an operator the ability to infect a target's OS X disk image... Read more...
Many technology companies have in place bug bounty programs that reward security researchers who submit discovered vulnerabilities in the products and services they offer. It is a win-win proposition in which technology companies are alerted to potentially crippling security holes, and hackers are compensated for their efforts. Apple is among the companies with a bug bounty program, though some researchers are choosing to hold onto discovered vulnerabilities, or worse yet, sell them on the underground market. Apple's is relatively new to the bug bounty scene. Ivan Krstic, head of Apple's security division, surprised attendees at last year's Black Hat conference by announcing the program, which... Read more...
Most wireless routers are equipped with a series of LEDs to indicate things like network connectivity and activity, though if a router has been compromised with malware, those blinking lights could reveal more than the owner bargained for. Using specially crafted malware, an attacker could instruct those LEDs to transmit data in a binary format.Image Source: TP-Link The attack was outlined in a paper by a team of researches from the Cyber Security Research Center at the Ben-Gurion University of the Negev in Israel. It is the same team of security researchers that previously wrote about data exfiltration schemes involving hard drive LEDs, coil whine, headphones, and other unique methods. A proof-of-concept... Read more...
New and used games retailer GameStop has found itself in a bit of a rough patch these days. The company recently reported less-than-stellar fourth quarter results and is planning to close at least 150 brick-and-mortar locations, and perhaps as many as 225. That is on top of the store locations it closed just a few years ago. While it deals with ways to increase revenue and profits, it now finds itself investigating a potential security breach that may have compromised credit card and customer data. Security hound KrebsOnSecurity heard from two unnamed sources in the financial industry that they received alerts from a credit card processor indicating that GameStop was likely hacked sometime between... Read more...
The latest bombshell to come out of WikiLeaks’ Vault7 series of leaks from the CIA, exposes a tool codenamed “Grasshopper”, which allows operatives to deploy persistent surveillance and hacking payloads on target Windows-based computer systems and remain undetected from popular anti-malware and anti-virus tools.WikiLeaks has an array of documentation on-line, including an in-depth user’s guide for Grasshopper. The user’s guide explains that Grasshopper is “a software tool used to build custom installers for target computers running Microsoft Windows operating systems”, which seems straightforward enough, and quite frankly the kind of thing you’d expect an intelligence agency to have... Read more...
Apple is not going to play ball with a group of hackers that is threatening to remotely wipe hundreds of millions of iPhone devices if the Cupertino outfit refuses to pay a ransom. While the hackers claim to have a large cache of iCloud and other Apple email account data at their disposal, Apple insists that its systems and servers remain secure and have not been infiltrated."There have not been any breaches in any of Apple's systems including iCloud and Apple ID," an Apple spokesperson told multiple media outlets. "The alleged list of email addresses and passwords appears to have been obtained from previously compromised third-party services."Apple added that it's "actively monitoring" its systems... Read more...
Security researchers at Cybellum, a PC security firm in Tel Aviv, Israel, have discovered a rather nasty new zero-day attack that allows remote attackers to hijack popular antivirus programs and turn them into malicious agents. The technique is called DoubleAgent, named after the fact that a compromised antivirus agent might give the illusion that it's protecting a PC when it's actually installing malware. "DoubleAgent exploits a 15 year old vulnerability which works on all versions of Microsoft Windows, starting from Windows XP right up to the latest release of Windows 10. The sad, but plain fact is that the vulnerability is yet to be patched by most of the antivirus vendors and could be used... Read more...
Prev 1 2 3 4 5 Next ... Last