Crack Rule

'Simple attacks' Lulzsec swoop

I know you may have seen this before but I found this so hilarious that everyone must see this. A while back E-harmony was hacked and many personal dating profile videos were copied from the servers. One video stood out so much they needed to share it with the world!. Here is the video.

<iframe width="420" height="315" src="http://www.youtube.com/embed/mTTwcCVajAc" frameborder="0" allowfullscreen></iframe>

A group of hackers identifying itself as "Ghost Shell" said that he has leaked some 120,000 pieces of information from 100 universities across the globe including Harvard University and the University of Cambridge

Today reports says that Servers at the University of Tokyo and four other major universities in Japan have apparently been attacked by hackers, and same hacker release IDs and passwords from databases.

- See more at: http://thehackernews.com/2012/10/tinkode-sentenced-by-romanian-court-and.html#sthash.A1w4utmJ.dpuf


- See more at: http://thehackernews.com/2012/10/tinkode-sentenced-by-romanian-court-and.html#sthash.A1w4utmJ.dpuf

Cafes may be unintentionally hosting a new bastion of Internet lawlessness. At least, that's what one politician is saying. Seems hacking's so easy, even a senator's aide can do it (and did, yesterday, at a press conference in a Manhattan coffee shop).

According to the latest cyber report by the Trustworthy Internet Movement (TIM), a nonprofit organization dedicated to solving Internet security, privacy and reliability problems, 90% of the websites running on HTTPS enabled secure protocol are vulnerable to the SSL attack, BEAST.

This report is based on the data provided by SSL Pulse project. This project scanned top 1 million websites with the automated scanning technology developed by security vendor Qualys and then generated a report on strength of HTTPS implementations. It checks what protocols are supported by the HTTPS-enabled websites (SSL 2.0, SSL 3.0, TLS 1.0, TLS 1.1, etc.), the key length used for securing communications (512 bits, 1024 bits, 2048 bits, etc.) and the strength of the supported ciphers (256 bits, 128 bits or lower).

90% od the websites scanned are vulnerable to the known type of attack BEAST. This SSL attack takes advantage of a flaw in SSL 3.0, allowing the attacker to grab and decrypt HTTPS cookies on an end user’s browser, effectively hijacking the victim’s session. This could be achieved either through an iframe injection or by loading the BEAST JavaScript into the victim’s browser, but BEAST is known to be especially hard to execute.

Trustworthy Internet Movement has also created a taskforce which includes various security experts who will review SSL governance issues and develop proposals aimed at fixing both SSL and the certificate authority systems. The taskforce members include Michael Barrett, chief information security officer at PayPal; Taher Elgamal, one of the creators of the SSL protocol; Adam Langley, a Google software engineer responsible for SSL in Chrome and on the company's front-end servers; Moxie Marlinspike, the creator of the Convergence project, which offers an alternative method for SSL certificate validation; Ivan Ristic, the creator of the Qualys SSL Labs and Ryan Hurst, chief technology officer at certificate authority GlobalSign.

The recent Flashback/Flashfake malware outbreak targeting Apple's Mac computers is likely to be just the start of a new wave of attacks aimed at the system, Kaspersky founder and CEO Eugene Kaspersky exclusively told CBR.
Speaking exclusively to CBR at Info Security 2012, Kaspersky told us that Apple is a long way behind Microsoft when it comes to security and will have to change the ways it approaches updates following the recent malware attacks."I think they are ten years behind Microsoft in terms of security," Kaspersky told CBR. "For many years I've been saying that from a security point of view there is no big difference between Mac and Windows.

It's always been possible to develop Mac malware, but this one was a bit different. For example it was asking questions about being installed on the system and, using vulnerabilities, it was able to get to the user mode without any alarms."Kaspersky added that his company is seeing more and more malware aimed at Macs, which is unsurprising given the huge number of devices being sold. Its most recent quarter revealed Mac sales of 4 million, a 7% rise on the year ago quarter.

List of Best sites to learn Malware Analysis are you interested to learn Malware analysis and searching for the best resources?! Ok , i will give the list of sites where you can learn the malware analysis.
Malware Analysis Tutorials: a Reverse Engineering Approach
A series of Malware analysis tutorial written by Dr. Xiang Fu. In this blog, you will learn how to setup your malware analysis lab and do code analysis part using Immunity Debugger.
Link: Dr. Fu's Security Blog

In one of my posts, i explained how to check a website is safe or not using McAfee siteAdvisor add on.  But ,checking with one site is not enough.  To make sure whether site is free from malware or not, we have to verify the target-link with few more sites.

Learn malware analysis fundamentals from the primary author of SANS' course FOR610: Reverse-Engineering Malware (REM). More at LearnREM.com.

In this session, Lenny Zeltser will introduce you to the process of reverse-engineering malicious software. He will outline behavioral and code analysis phases, to make this topic accessible even to individuals with a limited exposure to programming concepts. You'll learn the fundamentals and associated tools to get started with malware analysis.

The Flame computer virus that smoldered undetected for years in Middle Eastern energy facilities confirmed fears that the world has entered a new age of cyber espionage and sabotage.
Internet defenders on Wednesday were tearing into freshly exposed Flame malware (malicious software) that could be adapted to spread to critical infrastructures in countries around the world.While the components and tactics of Flame were considered old school, the gigantic virus's interchangeable software modules and targeted nature were evidence that malware is a potent weapon in the Internet era."We are seeing much more specific types of malware and attacks," said McAfee Labs director of security research David Marcus."When you talk about a situation where the attacker knows the victim and tailors the malware for the environment it jumps out," he said. "That speaks to good reconnaissance and an attacker who knows what they are doing."Gathering intelligence on targets and then crafting viruses to exploit specific networks as well as the habits of people using them is "certainly in vogue" and is an attack style heralded by the Stuxnet malware, Marcus said.Stuxnet, which was detected in July 2010, targeted computer control systems made by German industrial giant Siemens and commonly used to manage water supplies, oil rigs, power plants and other critical infrastructure.Most Stuxnet infections were discovered in Iran, giving rise to speculation it was intended to sabotage nuclear facilities there, especially the Russian-built atomic power plant in the southern city of Bushehr.Suspicion fell on Israel and the United States, which have accused Iran of seeking to develop a weapons capability under the cover of a civilian nuclear drive. Tehran denies the charges."Stuxnet and Duqu belonged to a single chain of attacks, which raised cyberwar-related concerns worldwide," said Eugene Kaspersky, founder of Kaspersky Lab, which uncovered Flame."The Flame malware looks to be another phase in this war, and it's important to understand that such cyber weapons can easily be used against any country."Flame malware was larger than Stuxnet and protected by multiple layers of encryption.It appears to have been "in the wild" for two years or longer and prime targets so far have been energy facilities in the Middle East.High concentrations of compromised computers were found in the Palestinian West Bank, Hungary, Iran, and Lebanon. Additional infections have been reported in Austria, Russia, Hong Kong, and the United Arab Emirates.Compromised computers included many being used from home connections, according to security researchers who were looking into whether reports of infections in some places resulted from workers using laptops while traveling.While Stuxnet was crafted to do real-world damage to machinery, Flame was designed to suck information from computer networks and relay what it learned back to those controlling the virus.Flame can record keystrokes, capture screen images, and eavesdrop using microphones built into computers.In an intriguing twist, the malware can also use Bluetooth capabilities in machines to connect with smartphones or tablets, mining contact lists or other information, according to security researchers."There is lot of intelligence gathering and espionage-like behavior from the malware," Marcus said. "You can turn that to target any industry you want."It looks like the infection spread is specific to Middle East, but malware is indiscriminate in a lot of things so it can jump," he continued.Marcus advised companies to not only keep network software up to date but to ratchet up security settings because threats such as Flame are carefully crafted to "fly under the radar."For example, Flame reportedly sneaked back out to the Internet by activating a seemingly innocuous Internet Explorer online browsing session.Geographically targeted cyber espionage and even modular components in viruses have been around for years, Rik Ferguson of security firm Trend Micro said in his blog at countermeasures.trendmicro.eu.Flame stands out for being a malware behemoth of nearly 20 megabytes and for its use of Bluetooth capabilities, according to Ferguson, who branded the malware a tool, not a weapon."You can't get around the fact that the thing is gigantic," Marcus said. "Someone went to a lot of trouble to really confound researchers. We are going to be ripping this sucker apart for a long time to figure everything it was doing."

There was a time when I was a beginner! Then I heard of Linux. I googled it and found lot of distributions or distros available. I was surrounded with dilemma of choosing the correct distro for learning and use.



Now I am here with a handy list categorized of Linux distros which will help you to choose according to your need and work. Moreover I will say that you can choose and work upon any Linux distribution once you are familiar with any one Linux environment. All the distros differ in system utilities, utilities and small working.


If you are unaware of Linux installation you can go through this (Installation of RHEL on Oracle Virtual Box). If you want to test some of the Linux without affecting your system, go through this (Run any OS on any OS) post.


So here is the list:
Live CD : The Live CD distros are useful to run the Linux system without installing it. It may help in case when there is no hard disk, system crashed or system access in lost. These type of distros can also be used with the help of USB instead of CD/DVD.Desktop : These distros include a collection of those utilities which are required by a normal user for home based usage like Music, Internet, Office etc with GUI.Security : These type of distros are used by the Information Security specialists for the security purpose. These are also used by hackers. These distros include all the security and hacking utilities. These distros are meant for advanced users.Enterprise Server : These distros are used for Server setups. The server can be of any kind like httpd, ftpd, dns, proxy etc. The server distro are less used with GUI and don't have common functionality like Music, Office, Internet Browsing etc.Utility Distro : The utility distro are miscellaneous and are used for specific purpose.GParted : The edit the partitions of Hard Drives.Ophcrack : To recover the lost Windows User Access i.e Passwords.PING : Used to rescue the crashed system, backup and restore etc.Trinity Rescue Kit : Its a rescue kit for the system.More information can be obtained on their respective links.


You can also suggest your Favorite Distro along with its usability which you liked.