news

Uniscan 4.0 vulnerability scanner Released

Wed, 24 Aug 2011 02:26:35 +0100

The Uniscan vulnerability scanner is aimed at information security, which aims at finding vulnerabilities in Web systems and is licensed under the GNU GENERAL PUBLIC LICENSE 3.0 (GPL 3). The Uniscan was developed using the Perl programming language to be easier to work with text, has an easy to use regular expressions and is also multi-threaded.

Uniscan Features

Identification of system pages through a Web Crawler.
Use of threads in the crawler.
Control the maximum number of requests the crawler.
Control of variation of system pages identified by Web Crawler.
Control of file extensions that are ignored.
Test of pages found via the GET method.
Test the forms found via the POST method.
Support for SSL requests (HTTPS).
Proxy support.

Official Change Log :- Uniscan is now Modularized.
- Added directory checks.
- Added file checks.
- Added PUT method enabled check.
- Bug fix in crawler when found ../ directory.
- Crawler support POST method.
- Configuration by file uniscan.conf.
- Added checks for backup of files found by crawler.
- Added Blind SQL-i checks.
- Added static RCE, RFI, LFI checks.
- Crawler improved by checking /robots.txt.
- improved XSS vulnerability detection.
- improved SQL-i vulnerability detection.

Kathmandu Metropolitan City website database hacked by T34mT!g3R

Wed, 24 Aug 2011 02:19:42 +0100

Hackers of Team "T34mT!g3R" today expose the SQL injection Vulnerability in Kathmandu Metropolitan City website and extract the database of site. Hacker post the Database info and Vulnerable Link at pastebin.

Turkish government website Hacked by kurdish hacker for bombarding Kurdistan Regions

Wed, 24 Aug 2011 02:17:19 +0100

Today a kurdish hacker "Mn Peshmargem" deface the website of Turkish government for protest against the bombarding done by the Turkish Military planes in Kurdistan Regions.
Message Posted by Hacker :

Fuck racism Turkish, fuck acursed Ataturk, fuck you Turkish the fad ended of the Mongolians
wait for your non honored soldiers, that they are embarrassed in front of a Peshmarga like me.
If a Kurd die, 100 honorless Turks must go to hell afterwards. You coward Turks are always honorless
and lost in front of a Peshmarga like me in the battle fronts. Do you want to hide your honorlessness
and cowardice by bombing the mountains in Kurdistan??? Be sure that you must pay back a debt for
bombing the mountains in Kurdistan. Fuck the honorless Turks,
viva Kurds and Kurdistan, viva Peshmarga.

Android Trojan GingerMaster Uses Gingerbread Root Exploit

Wed, 24 Aug 2011 02:12:44 +0100

As our smartphones become more ubiquitous and more powerful, they need to be protected in much the same way that you would protect your computer. Further to this, a malicious piece of malware has been discovered for devices powered by Android 2.3.3 Gingerbread, giving the hacker the ability to take complete control of the smartphone remotely. According to Assistant Professor Xuxian Jiang from the NCSU Department of Computer Science, the new threat, which his team has dubbed GingerMaster, is the first malware to use the root exploit for Android 2.3. "As this is the first time such malware has been identified, it is not surprising when our experiments show that it can successfully evade the detection of all tested (leading) mobile anti-virus software," he writes.

Once the GingerMaster malware is installed and has root privileges, it then reaches out to a remote command-and-control server and asks for instructions. It then has the ability to download and install apps on its own, without the user's permission, Jiang found. GingerMaster is an evolution of the existing DroidKungFu malware, which had some of the same functionality. Earlier this week, Jiang's team also found other variants of DroidKungFu in several dozen infected apps in alternate Android app stores. That version included a couple of root exploits as well, but for earlier versions of Android.

As far as we can tell, no “official” applications being offered through Android Market have been affected by GingerMaster, but it’s best to err on the side of caution when it comes to these things. Recognize that your Android smartphone is very much a computer and, as such, is just as vulnerable to attacks as your home PC. The researchers recommend that users take several steps to protect themselves. The first one is to run a mobile antivirus product. There are several free solutions available from vendors like Lookout, AVG, BitDefender or Symantec.Then, users should only download apps from trusted marketplaces, like the official Android Market. Unfortunately, there is no assurances that malware won't slip through the cracks and appear on these services from time to time, but the chances are lower than in other places.Finally, users should make a habit from reading and understanding the permissions requested by apps on installation. Trojanized apps will usually require permissions that legit versions wouldn't need.

Nokia website Hacked by pr0tect0r AKA mrNRG

Mon, 22 Aug 2011 13:36:03 +0100

NOKIA , One of the biggest Telecommunications Internet Computer software Company Website hacked by Indian Hacker "pr0tect0r AKA mrNRG" . He Deface the developer.nokia.com sub-domain of NOKIA and also RedirectAnother page to Custom Created Page.
Hacker wrote "LOL, Worlds number 1 mobile company but not spending a dime for a server security! FFS patch your security holes otherwise you will be just another antisec victim. No Dumping, No Leaking!!". Mirror of Hack is also Available on Zone-h. One week before , Pakistan one of the biggest forum Defence.pk was also Hacked by pr0tect0r A.K.A. mrNRG in occasion of Independence Day.

Call for Papers from DefCon Chennai (DC602028)

Mon, 22 Aug 2011 13:33:04 +0100

Background:
We are the Official DEF-CON Chennai Group [DC602028]
The Event is taking place on 11th September 2011 at a resort in ECR Road Chennai,India.
We will be having a Private conference room for the meet.

Regarding Paper Submission
We require uniqueness when it comes to Paper submission for DEF-CON Chennai DC602028.

Uniqueness as Follows:
-> Papers can be on your own research with proof of concept.
-> Paper should be of current subject and not more than 1 year old.
-> Topics of interest includes everything related to Security.
-> Topics related to mobile security or Anroid Security .
-> Any new methods of hacking or any 0day/tool disclosure

Some of the Sample Topics
= New threats faced by Corporate
= Threats faced by Normal user from a Malicious person
= Mobile security and Mobile Application
= Denial of Service attack
= Cyber laws
= Forensics
= Webapp Vulnerabilities
= Online Fraud and Social Engineering

Your submission must contain the following information.
Please send your paper to defchennai@gmail.com
1. Author name
2. Email Address
3. Mobile Number
4. Brief Biography
5. Title of the Paper
6. Provide Supporting Materials for your paper in form of PDF or Links
7. Presentation Format must be in PDF or PPT
PS: Presentation should not exceed more than 20 minutes

Further Information on Dates:
Paper submission last date : 3 September 2011
Notification of paper Acceptance : 5 September 2011
Paper Presentation : 11 September 2011
For updates Check our Blog www.defcontn.com
Please send your paper to defchennai@gmail.com

Idea Cellular Web Portal Hacked, Customers Info may be exposed !

Sat, 20 Aug 2011 20:17:59 +0100

Again a critical SQL Injection Vulnerability has been discovered by zSecure Team in a high profile web portal. This time it's Ideacellular web portal which compromises the entire site database. Any malicious smart black hats can create much more devastating attacks using this critical flaw such as: complete access to various database’s as shown in screen-shots under proof of vulnerability which can later be misused to access various confidential information; complete database dump; possibility of uploading shell (not fully certain) and much more.

Target Website: http://www.ideacellular.com

Attack Type: Hidden SQL Injection Vulnerability

Database Type: MySql 5.0.27
Alert Level: Critical

Threats: Database Access, Database Dump
Credit: zSecure Team
Previous Vulnerability Discolsures: Dukascopy, Sify, TimesofMoney, Sharekhan

About the Company

Idea is the 3rd largest mobile services operator in India. Idea’s strong growth in the Indian telephony market comes from its deep penetration in the non-urban and rural markets. IDEA Cellular is an Aditya Birla Group Company, India’s first truly multinational corporation. The group operates in 26 countries, and is anchored by over 130,600 employees belonging to 40 nationalities. The Group has been adjudged the ‘6th Top Company for Leaders in Asia Pacific Region’ in 2009, in a survey conducted by Hewitt Associates, in partnership with The RBL Group, and Fortune. The Group has also been rated ‘The Best Employer in India and among the Top 20 in Asia’ by the Hewitt-Economic Times and Wall Street Journal Study 2007.

Disclaimer

No data has been dumped; zSecure Team randomly tried the security of ideacellular web portal and in our very first attempt they discovered this critical flaw. Since this flaw was discovered in their very first attempt, existence of other flaws can’t be denied.

Database has been accessed just to take screenshots so that they can make company believe that the aforesaid flaw actually because most of the companies use to treat the like advisories/disclosure as junk and don’t believe the researcher’s which may later cause them huge.

As well said zSecure Team respect the confidentiality of Ideacelluar that’s why they restricted the contents of their screen-shots to database tables only. W e hope that company Ideacellular will take some immediate steps to fix-up this critical vulnerability asap.

25 Year old UK Student hacker penetrated Facebook‎

Sat, 20 Aug 2011 19:57:55 +0100

A 25 year old Brit allegedly used "considerable technical expertise" to hack into Facebook's servers. The student, from York, faces five charges, including that he “made, adapted, supplied or offered to supply” a computer program to hack into a Facebook server, Westminster magistrates’ court heard.

Mangham, a resident of York, was arrested by the e-Crime Unit of the Metropolitan Police in June this year; and has been charged with five offences under the Computer Misuse Act. Mangham is currently on bail, and like all accused hackers has been prohibited from accessing anything even resembling a computer. "The court feels it will be safer if there was no access to the internet which will reduce the temptation for your son to go on to Facebook," said Judge Evans.

As per Facebook, no personal information had been compromised during the hacks attempted by Mangham. The social network also added that it had been working with Scotland Yard and the FBI since the officials “take any attempt to hack our internal systems extremely seriously.”

Opera 10 now available online

Tue, 16 Aug 2011 16:29:31 +0100

Oslo - Version 10 of the Opera web browser is now available. The biggest innovation in this latest product from the Norwegian software designers is its Turbo compression technology. It provides quicker loading of web content even for slow internet connections.

The developers have also redone the browser's interface and provided spell checking and options for enlarging and reducing the tab bar.

The newest version can be downloaded for free at opera.com. Opera is available for Windows, Mac and Linux operating systems. (dpa)

You can download it in our downloads..

Deadlines of Firefox 3.6 and 4.0 Extended by Mozilla

Tue, 16 Aug 2011 16:24:14 +0100

It seems that Mozilla would not be able to keep its 2009 deadline for aFirefox 3.6 release, and is also giving itself more time to come out with a major update, the version 4.0.

Mozilla, the firm behind the open-source web browser, which is also the most popular currently, had shared that it would release a Firefox 3.6 version in December 2009, but now, the Mozilla site now states that "ship Firefox 3.6" is a goal it expects to reach during 2010's first quarter.

Also, Firefox 4.0, which was supposed to come out in early 2010, is now expected to surface during "late 2010 or early 2011", a beta will be out in the Summer of 2010.

Although delays in schedules are common in the software world, this lax has come at a badtime for Mozilla as the web browsers segment is set to get very competitive, especially ever since Google's Chrome has hit the scene. Also, Apple and Opera are pushing all limits to see what new their browsers can offer. Also, Microsoft and its Internet Explorer are getting more and more ambitious with each passing day.

"We've always been more quality-driven than time-driven, but we understand timing in the market matters to our users and our competitiveness", said Mike Shaver, Mozilla's Vice President of Engineering. Seems like Mozilla will have to step up its efforts or it might just not be a favorite of the users for very long.