Linux Hacks & Cracks - Page 69

We have thousands of posts on a wide variety of open source and security topics, conveniently organized for searching or just browsing.

Discover Hacks/Cracks News

Former hacker praises Microsoft on security

data:image/svg+xml,%3Csvg%20xmlns=%22http://www.w3.org/2000/svg%22%20viewBox=%220%200%20100%20100%22%3E%3C/svg%3E

There's no safe place on the Web, reports former hacker Marc Maiffret, who shared some interesting insights recently with CNET.com regarding Internet security. Nearly a decade after he exposed the vulnerability used by the Code Red worm, Maiffret gave Microsoft's security model high marks.

Twitter 'botnet creator' spotted

data:image/svg+xml,%3Csvg%20xmlns=%22http://www.w3.org/2000/svg%22%20viewBox=%220%200%20100%20100%22%3E%3C/svg%3E

Security experts have discovered a tool that can be used to initiate denial-of-service attacks using micro-blogging site Twitter. A tool that lets criminals infect other PCs and turn them into 'bots' controlled through Twitter has been spotted by security experts.

XSS vulnerability fixed in Drupal module - Update

data:image/svg+xml,%3Csvg%20xmlns=%22http://www.w3.org/2000/svg%22%20viewBox=%220%200%20100%20100%22%3E%3C/svg%3E

The development team behind the Drupal module Context have released version 6.x-2.0-rc4, which fixes a cross-site scripting (XSS) vulnerability when displaying block descriptions. If a user with 'administer blocks' permission clicks on a crafted link, JavaScript contained in the link is executed with the privileges of the Drupal page. Attackers can exploit this to gain access to a system.

New attack bypasses anti-virus software

data:image/svg+xml,%3Csvg%20xmlns=%22http://www.w3.org/2000/svg%22%20viewBox=%220%200%20100%20100%22%3E%3C/svg%3E

A (nearly) new attack method is reportedly able to bypass anti-virus software for Windows in order to, for example, load infected drivers, despite protection mechanisms. The attack, developed by Matousec.com, makes use of the fact that many anti-virus programs hook into the kernel's System Service Descriptor Table (SSDT) in order to monitor program behaviour.

Zero-day exploit for Safari

data:image/svg+xml,%3Csvg%20xmlns=%22http://www.w3.org/2000/svg%22%20viewBox=%220%200%20100%20100%22%3E%3C/svg%3E

Security company Secunia is warning of a critical vulnerability in Apple's Safari browser. The current version (4.0.5) and possibly older versions are affected. If a user visits a website containing the exploit using the Windows version of Safari, the site can compromise the system and either crash the browser or execute malicious code. The problem is caused by an error in the way the browser deals with pop-ups.

Large-scale attack on WordPress

data:image/svg+xml,%3Csvg%20xmlns=%22http://www.w3.org/2000/svg%22%20viewBox=%220%200%20100%20100%22%3E%3C/svg%3E

According to various reports, in the past few days a number of websites created using WordPress have been hacked. While the attack initially appeared to be limited to web sites hosted by American ISP DreamHost, it has since become apparent that blogs hosted at GoDaddy, Bluehost and Media Temple have also been affected.

Man charged in US for reprogramming cash machines

data:image/svg+xml,%3Csvg%20xmlns=%22http://www.w3.org/2000/svg%22%20viewBox=%220%200%20100%20100%22%3E%3C/svg%3E

The US public prosecutor has charged a 19-year old man with attempting to reprogram cash machines. The man planned to exploit configuration options on cash machines manufactured by Tranax, which allow note denomination settings to be altered after entering a specific key sequence from the keypad (Tranax 1700: Enter, Clear, Cancel, 1,2,3) and a (default) password.

Malware hides from search engines

data:image/svg+xml,%3Csvg%20xmlns=%22http://www.w3.org/2000/svg%22%20viewBox=%220%200%20100%20100%22%3E%3C/svg%3E

Criminals are increasingly attempting to conceal malware embedded in hacked websites from search engines such as Yahoo! and Google. Their aim is to prevent browsers which use technology such as Google's Safe Browsing API from sounding the alarm when a user visits a hacked website. Google's Safe Browsing API allows client applications to query Google's phishing and malware blacklist. Firefox and Google Chrome both make use of the API, which is based on Google searches of websites for suspicious code.

Hacker runs Google's Android on Apple's iPhone

data:image/svg+xml,%3Csvg%20xmlns=%22http://www.w3.org/2000/svg%22%20viewBox=%220%200%20100%20100%22%3E%3C/svg%3E

There are matches made in heaven, and on the other side of the spectrum, there is David Wang's accomplishment: booting Google's Android operating system on Apple's iPhone Wang, the "planetbeing" member of the a group called the iPhone Dev Team devoted to hacking iPhones, on Wednesday posted a video demonstrating Android on an iPhone.