Ramgen-Janelle Scandal video posted on deface page of Philippines Premiere Bank

A defaced linked of the official website of the Premiere Bank Philippines which contains a video of Ramgen-Janelle Sex Video Scandal is the talk of the town and widely spread in the IRC and Facebook today. The defacer who uploaded the video claims to be kenjie miranda of h4ckz0n3.The defacer who uploaded the video claims to be kenjie miranda of h4ckz0n3.

Regarding with the case of this video which violates the ANTI- VOYEURISM LAW OF 2009, Senator Revilla Jr. already asked the National Bureau of Investigation to investigate the spread of Ramgen-Janelle intimate video. The video is already viral in torrent sites and forums sites.

Read More

Ping.fm vulnerable to Clickjacking (Video Demonstration)

Two Indian Hackers Aditya Gupta(@adi1391) and Subho Halder (@sunnyrockzzs) have discovered Clickjacking vulnerability in one of the famous website "Ping.FM". Clickjacking is a malicious technique of tricking Web users into revealing confidential information or taking control of their computer while clicking on seemingly innocuous web pages.



This is based on a technique known as clickjacking ( or UI Redressing ) where an attacker could perform actions on the behalf of user by tricking the user to click on a button or perform some other action.

This vulnerability was earlier seen in Twitter where it allows the status to be loaded through the GET method, and an attacker could frame the twitter webpage and trick the user to click on the tweet button, with the user thinking that its a part of the attacker's webpage.

This can be disabled by setting the X-FRAME-ORIGIN method to SAME ORIGIN or DENYING the use of webpage inside a frame which have been adopted by google, facebook and many other famous websites.

Ping.fm is a online service which allows the user to connect to many social networks at once. However an attacker could use a technique known as Clickjacking to silently update the user's social networking status at Twitter, Facebook and all other connected accounts.In this technique, the user is tricked into clicking on a button on a webpage designed by the attacker,which silently updates the status of the user on the social netowrks status taking advantage of thePing.fm API and clickjacking technique.


Video Demonstration POC :

Read More

Next Microsoft Patch Tuesday include BEAST SSL fix

Microsoft’s first batch of patches for 2012 will include fixes for security vulnerabilities in the Windows operating system and Microsoft Developer Tools and Software. The patches will be released next Tuesday (Jan 10, 2012) at approximately 1:00 PM EST.

The solitary critical bulletin in the batch fixes a remote code execution issue in Media Player. The remaining six important bulletins due next Tuesday handle the BEAST SSL issue and various information disclosure bugs, escalation of privilege issues and an update to Microsoft’s SEHOP (Structured Exception Handler Overwrite Protection) technology to enhance the defence-in-depth capability that it can offers to legacy applications.

The BEAST/SSL patch was supposed to have been included in December's Patch Tuesday release but had been pulled at the last minute due to some testing problems involving a third-party vendor, according to Microsoft. Henry noted that despite all the hype after the BEAST attack tool was released over the summer, attacks exploiting the SSL flaw simply never materialized.

Microsoft issued an out-of-band security update on Dec. 29 to close four serious vulnerabilities in the .NET framework. One of the vulnerabilities could be exploited to launch hash collision attacks on Web applications built on ASP.NET and trigger a denial of service. The .NET patch had originally been scheduled for the January release, but the company moved up the date in order to issue the ASP.NET fix as an emergency patch.The DoS zero-day exists in other Web application frameworks as well. But Microsoft and Apache appear to be the only ones who have addressed the issue to date.

Read More

Hackers selling cheap BOTNETs and DDOS on forums

The Internet has revolutionized shopping around the world. Security researchers F-Secure reported recently in a post that hackers are Selling Cheap DDOS services on Various Forums. Hackers are offering services like distributed denial of service attacks (DDoS), which can be used to knock website offline in just 1 - 2 hours / 2$ per hour. They Posted a Youtube Video
in which a young woman advertises DDoS services.



"We are here to provide you a cheap professional ddos service.We can hit most large websites/forums game servers.We will test the website/server before accepting your money.Due to the nature of the business we dont offer refunds." Offer said.



There is another Interesting Hacker's Shop ! Moreover, for their assaults, the hackers chiefly utilize botnets, while ignorant operators of computers remain unaware that they've gotten contaminated with malware as also being controlled remotely.

"Do you want to be king of the internet? If your answer is yes, then you are in the true place. All of programs has been made by professional coders." This website selling Local Botnet, Irc Botnet, Web Botnet and Keyloggers at 59$ only.

Read More

Sony Pictures Facebook Page & Website Hacked again !

The hacking group Anonymous has confirmed that they have once again hacked Sony Pictures, gaining access to their Facebook account and website. Anonymous did threaten Sony for supporting the controversial SOPA bill and now it seems that the threats materialized.


The hack hit the Sony Pictures Facebook page and its web site homepage, according to reports and tweets from those involved. Comments were left on the web pages, but have since been removed.




The attacks carry the name Op Sony and were noted through the @s3rver_exe Twitter account. "#OpSony SonyPictures Hacked! by s3rver.exe , Anonnerd and N3m3515," says a tweet from that user, who continued, "I uploaded a @YouTube video (link removed) Sony Pictures Hacked By Anonymous."



“Your support of the act is a signed death warrant to Sony Company and Associates. Therefore, yet again, we have decided to destroy your network. We will dismantle your phantom from the internet. Prepare to be extinguished. Justice will be swift, and it will be for the people, whether some like it or not,” Anonymous.

"The hack wasn't big, but still the servers were vulnerable and I got access to the admin too," Hacker Said.

Anonymous caused major problems for Sony in 2011 after successfully hacking into the firm's online gaming network and stealing the login information of thousands of users, forcing the system offline for several weeks.

Read More

FreeDOS 1.1 released after being in development for several years

FreeDOS 1.1 has been released after being in development for several years. FreeDOS is an opensource operating system aiming to provide the same (or better) functionality as Microsoft'sold MS-DOS. Right now the main use is running old games and software, but you might encounter it on somefreshly sold computers, motherboard setup CDs, BIOS flashing diskettes, embedded hardware and other uses.


Bernd Blaauw has been hard at work, updating FreeDOS distribution to include the latest packages. Bernd writes: "In its current form this new distribution is best suited as a CD-ROM disk to install FreeDOS from onto harddisk. Sources are included. It might be considered as replacement for the current 'base-only' 1.0 distributions as created by Blair and Jeremy, however it's less functional as it's missing the Live Environment part (\FDOS directory on CD)."


New Version include the FreeDOS 2040 kernel, a new suite of high-performance TCP/IP x86 applications, initial USB UHCI controller support, a new install menu from the CD, a universal BIOS back-up program (FlashROM), updated memory drivers, limited USB flash disk support, and many program updates.

Get free DDOS 1.1

Read More

Ramnit Worm steals 45000 Facebook passwords

A new variant of the Ramnit worm has managed to steal log-in credentials for several thousand Facebook accounts, most of which were from the United Kingdom and France, according to researchers at Seculert. Evidence recovered from a command-and-control server used to coordinate the evolving Ramnit worm confirms that the malware has already stolen 45,000 Facebook passwords and associated email addresses.

Discovered in April 2010, the Microsoft Malware Protection Center (MMPC) described Ramnit as “a multi-component malware family which infects Windows executable as well as HTML files”, “stealing sensitive information such as stored FTP credentials and browser cookies”. In July 2011 a Symantec report [PDF] estimated that Ramnit worm variants accounted for 17.3 percent of all new malicious software infections.


Trusteer previously reported in August of last year Ramnit gained the ability to “bypass two-factor authentication and transaction signing systems, gain remote access to financial institutions, compromise online banking sessions and penetrate several corporate networks.” Seculert, using Sinkhole, found that 800,000 machines had been infected with the worm in the last quarter of 2011.




It was fairly straightforward to detect that over 45,000 Facebook login credentials have been stolen worldwide, mostly from users in the United Kingdom and France. In a statement, Facebook said it was applying security measures to contain the problem.

“Last week we received from external security researchers a set of user credentials that had been harvested by a piece of malware. Our security experts have reviewed the data, and while the majority of the information was out-of-date, we have initiated remedial steps for all affected users to ensure the security of their accounts. Thus far, we have not seen the virus propagating on Facebook itself, but have begun working with our external partners to add protections to our anti-virus systems to help users secure their devices. People can protect themselves by never clicking on strange links and reporting any suspicious activity they encounter on Facebook. We encourage our users to become fans of the Facebook Security Page (www.facebook.com/security) for additional security information."

As ever, be careful what you click on in Facebook, even if the link is provided by a friend and and try not to use the same password for multiple services.

Read More

Hackers leak the Source Code for Symantec Product

img src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgVY4KmT2eOd-PLgyvyH9bORcEuaTC3QaP7iwq0ERy7qHALA_tEvoG7CTvaDvOergcIP7zzner4Z51Ay4lTDzVx8L9yn3Ti9AZORcdSMkQR59lJS4YuVqVqk64jmifs-0CU9sOskDolZMw1/s640/bitpix-symantec-hq1-tmagArticle.jpg" />
A group calling itself the Lords of Dharmaraja posted an Adobe document online Wednesday that it claimed was a glimpse of the source code for the internet security software. But Symantec spokesman Cris Paden said "no source code was disclosed" in the post, which was a 12-year-old document describing how the software worked, but not the code. Paden said Symantec continues to investigate the hackers' claim that they have source code.

But now Symantec, the makers of Norton AntiVirus, has confirmed that a hacking group has gained access to some of the security product's source code.



"Symantec can confirm that a segment of its source code has been accessed. Symantec’s own network was not breached, but rather that of a third party entity.We are still gathering information on the details and are not in a position to provide specifics on the third party involved.Presently, we have no indication that the code disclosure impacts the functionality or security of Symantec's solutions. Furthermore, there are no indications that customer information has been impacted or exposed at this time."



In a post to the site Pastebin, the hackers maintain they discovered the information in a hack of India's military computer network. The group claims to have found source code "of a dozen software companies" which have signed agreements to share code with Indian intelligence agencies.

After preliminary analysis appeared to contain source code for the 2006 version of Symantec's Norton antivirus product. Though the code is for an older version of the Norton antivirus product, the impact of the exposure is still as of yet undetermined. Symantec officials have indicated they will be providing more information as they continue their investigation, and certainly more will be known if the entirety of the compromised data YamaTough claims to be in possession of is finally released to the public as has been threatened.

Read More

Facebook Hacker Cup 2012

Are you a good programmer and security junkies? If yes then its your time to prove your skills. Facebook wants you to prove it at its second annual Hacker Cup challenge. The Facebook Hacker Cup is an annual worldwide programming competition where hackers compete against each other for fame, fortune, glory and a shot at the coveted Hacker Cup.

Open to coders anywhere in the world, Facebook's competition pits participants against each other in five rounds of programming challenges. The first kicks off January 20 with a 72-hour qualification round. Three more online rounds will thin the field down to the final 25 competitors, who will be flown out to Facebook's Menlo Park, Calif., headquarters for a final competition in March.
The winner will receive a $5,000 cash prize. Last year, nearly 12,000 programmers participated in the Hacker's Cup. Petr Mitrichev, a Google employee from Russia, took home the top prize.



According To Facebook:-

Hacking is core to how we build at Facebook. Whether we’re building a prototype for a major product like Timeline at a Hackathon, creating a smarter search algorithm, or tearing down walls at our new headquarters, we’re always hacking to find better ways to solve problems.
Today we’re announcing open registration for Facebook’s second annual Hacker Cup. Programmers from around the world will be judged on accuracy and speed as they race to solve algorithmic problems to advance through up to five rounds of programming challenges. This is your chance to compete against the world’s best programmers for awesome prizes and the title of World Champion.

What: An annual algorithmic programming contest open to engineers from around the world.
Where: Three online rounds with the finals at Facebook's headquarters in California.
When: Registration opens January 4, 2012 with the three online rounds occurring throughout January 2012. World finals to follow.
Finals: We'll pay to fly and accommodate the top 25 hackers from the third online round out to our campus.
Prizes: Of course! $5,000 USD and title as world champion to the top hacker, $2,000 for second place, $1,000 for third, and $100 for fourth through 25th. Awesome t-shirts for the top 100 hackers coming out of the second online round.

For More Details Click Here

Read More

Anonymous Gave Warning To Sony (#OpBlackout, #OpLulzxmas, #OpMayhem)

Earlier we have told that Anonymous has reacted against the controversial Stop Online Piracy Act (SOPA) reconvenes by the US Senate. This bold protest of Anonymous continues. Recently the have posted a YouTube video declaring that they will hack Sony again. If Sony doesn't stop their support of the Stop Online Piracy Act. They have specifically said they are not hacking the PlayStation Network. "We're hacking the SONY network and exploiting its servers. NOT PLAYSTATION NETWORK"

According To The Video:-


"Your support to the act is a signed death warrant to SONY Company and Associates," Anonymous saidin the video. "Therefore, yet again, we have decided to destroy your network. We will dismantle your phantom from the internet. Prepare to be extinguished. Justice will be swift, and it will be for the people, whether some like it or not. Sony, you have been warned."


A Message From Anonymous To Sony:-



Brief About SOPA:-

The Stop Online Piracy Act is a bill that was introduced in the United States House of Representatives on October 26, 2011. The bill will increase the power of the U.S. Department of Justice and copyright holders. The bill "would expand the ability of federal law enforcement to shut down foreign Web sites and services that that use counterfeited or pirated content created by U.S. firms."

Read More

Hackerspace Global Grid Project (Satellite For Hackers)

German hackers is trying to start a movement to build a communications satellite that could support unrestricted channels on the Internet. The project, called the Hackerspace Global Grid, would consist of at least one satellite in low-Earth orbit providing connections among independent ground stations – creating a network of nodes completely independent of the Internet itself.
"The first goal is an uncensorable internet in space," said hacktivist Nick Farr, who began the call for a satellite project in August in response to new Internet restrictions in China, Libya, Syria and other authoritarian countries as well as pressure to suppress commercial content in Western countries with laws such as the Stop Online Piracy Act (Sopa). "Let's take the Internet out of the control of terrestrial entities."
Ground stations would cost between $100 and $150 for receivers that would use GPS to determine where the satellite should be and zero in on its signal, they said.

Read More

From the In-Security Land to Security in the Cloud

"This article aims to share with you some thoughts and concepts associated with Cloud Computing and the risks involved for those who want to venture into the benefits it offers" -- Mariano M. Río

“From the In-Security Land to Security in the Cloud" will try to reflect how true it is that the cloud is dangerous or more dangerous than "land" and in turn how much of what is required to the cloud is rarely seen implemented on the ground.

When companies begin their assessment to go to the cloud, the first comments are generally related to the "dangers" associated with privacy and confidentiality of information, the availability of services and other issues that represent the cloud as an undesirable place to visit. This turns out to be real, but as real as could be the situation of exposure of the information in an organization that does not have security program information or at least care with basic information and associated assets.



Now, what is minimally expected from someone who cares about the privacy or confidentiality of information in the cloud is at least that the situation of your organization is better and there have been implemented controls to ensure these principles. Similarly, those aspects associated with the availability of services and issues related to continuity of operations and / or the receipt of information.

What really stands out is that the situation is more close to what they expect from the cloud, and which according to its critical position towards the latter should have on earth. Thus then there are no basic measures such as: an inventory of critical assets of the Organization, the classification of information, risk analysis, continuity of operations plans, product safety checks and risk analysis and surprisingly, the receipt of information. That is, being critical of the cloud does not have a basic security strategy for your organization, but what they expect from the cloud.

However, as has happened with other issues, you can see a global trend migrating to solutions in the cloud, some start with those applications or systems that have little relevance to the operations of the Organization, but hopefully that will quickly migrate more relevant services to reach the critical systems and applications.

What we should keep in mind is that, both the ground and in the cloud, security must be managed, with clear objective of accompanying the business through the changes that occur in the operation. There is no model that does not require management, risk assessment, implementation of controls, monitoring and accountability on the part of those involved. Having said this, then you might think that the real danger is people, in short is the lack of diligence on main risk to which information is displayed, no matter where they are. Do you still think that the management of safety and risk is a purely technological issue? Do we think that in any case the security problems of an organization are the responsibility of the IT area? Cases like Sony, Amazon, Google, DigiNotar, BlackBerry and other serious incidents make clear that security is a fundamental part of any service delivery today. However it doesn't seem that will be willing to assume the cost that could generate. For DigiNotar has been its bankruptcy.

Finally, for those interested in evaluating a solution in the cloud there are many resources available that can make the task much less complex and also with international endorsement, that may require areas to be making decisions. In this sense, you can find material in ENISA, INTECO, NIST, CSA, etc.
The Cloud Security Alliance (CSA) has developed a number of additional documents to the traditional guides that can greatly facilitate the evaluation and subsequent analysis of a solution provider, among which we could find:

Cloud Control Matrix (CCM).
Cloud Assessment Initiative (CAI).
Cloud Security Guidance (CSG).
Security As a Service (SecaaS).

Read More

Nmap 5.61TEST4 released with Web Spidering Feature !

Nmap release today an interesting version nmap 5.61TEST4 with number of interesting features. Also, to improve the user experience, the Windows installer nowinstalls various browser toolbars, search engine redirectors, andassociated adware.

a spidering library and associated scripts for crawling websites.
51 new NSE scripts, bringing the total to 297.
a substantial decrease in the size of the Mac OS X installer due to the removal of PPC support.
a new vulnerability management library which stores and reports found vulnerabilities.

Mac OS X packages are now x86-only (rather than universal), reducing the download size from 30 MB to about 17. Change Log can be found here and Download Here .

Read More

400000 Israeli Credit Cards & Information Leaked by Saudi Arabia Hackers

Hacker named "0xOmar" from group-xp, largest Wahhabi hacker group of Saudi Arabia claim to Hack lot of Israeli servers, lot of information about Israeli people including their name, address, city, zipcode, Social Security Numbers (Israeli IDnumbers), mobile phone number, home phone number, credit card number (including exp year, month and CVV). According to announcements from the credit card companies, 6,600 of the stolen cards belong to Isracard Ltd., 4,000 to Leumi Card Ltd., and 3,000 to Israel Credit Cards-Cal Ltd. (ICC-Cal) (Visa).

Hacker says "We daily use these cards to solve our problems, purchasing VPNs, VPSes, softwares, renting GPU clusters, renting cloud servers and much more!". They Claim themselves as part of Anonymous hacking Group from Saudi Arabian. "my goal is reacing 1 million non-duplicate people, which is 1/6 of Israel's population." He said.


Quick Description of Leaked Data at Pastebin:

4000.htm, it includes 4000+ credit cards and all needed information. All is Israeli.
27000.htm, it includes 27000+ credit cards and all needed information. All is Israeli.
Cards1.mdb, it includes 260272 credit cards and all needed information. It includes address, emails and passwords of 260272 Israeli people.
Cards2.mdb, it includes 120745 credit cards and all needed information. It includes address, emails and passwords of 120745 Israeli people.
IsraCards1.txt, it includes 184 working fresh Israeli credit cards and all needed information.
Business.mdb, it includes 22604 Israeli business people details, including, names, addresses, phone numbers, passwords, etc.
Judaism.txt, it includes 65 Zionist people who purchased stuff from Judaism web site
TblDonate.htm, it includes 500+ people who donated to Israeli Zionist Rabbis.

In response to the cyber attack, Dov Kotler, CEO of Isracard, a unit of Bank Hapoalim said that the credit-card user details that appeared on the page were mostly incorrect or belonged to the cards that were deactivated long ago. The leaked data also contains numerous repeated entries. The credit card companies immediately blocked all the cards on the list and assured the customers that money used to buy from these cards will be duly returned.

Read More

9 Top Patch Management Practices for Businesses Security

I've spent most of the past decade in information security, with a pretty big focus on incident response. It never ceases to amaze me how many security incidents (pronounced hacks) customers suffer as a result of unpatched systems. Patch management is not an art form; it's an underappreciated and often ignored part of what should be daily care and feeding of your infrastructure. Here are the nine best patch management practices I've learned over the years:

1. Automate your patching
If your patch management strategy depends upon manual effort, you're doing it wrong. Only the smallest businesses can handle patching by hand. You need a system that can deploy patches to all your systems; workstations and servers.
2. In-depth reporting
Automating doesn't mean ignoring. You should be able to see the state of your patch management at any point in time and know exactly which systems are in need of attention.
3. Testing and rollback
I lump these two together because they are two sides of the same coin. You need to test your patches; you may also need to roll them back. Good patch management includes both; testing things meticulously, and being able to roll back if the testing missed something.
4. Third party apps
The operating systems vendors do a pretty good job of making patching a no-brainer operation. It's the third party apps that tend to bite a lot of customers when they aren't looking. Make certain your patch management covers the apps that didn't come with your operating system.
5. Maintenance windows
I once worked an incident that ended up costing close to US $100K in down time, remediation, reporting and consumer credit monitoring. The server that was hacked was vulnerable because it was missing a patch. The patch was missing because the system owner wouldn't approve any downtime for patching –therefore no one ever got around to applying a critical patch for a known vulnerability. The hack happened almost a year to the day after the patch was made available. No system should be without a monthly maintenance window, and allowance must be made for emergency patches for zero-day issues.
6. Hardware
Don't overlook your hardware. Whether it's your network routers and switches, your wireless access points, or firmware versions on your laptop BIOS, make sure your patch management efforts keep up with the updates for these critical parts of your infrastructure.
7. Quarterly audits
Run quarterly audits of those reports, and inspect a random sampling of servers, workstations, and network gear to be sure your patch management solution is being applied appropriately.
8. Require all new systems be fully patched
Any new system; server, workstation, or infrastructure, should be fully patched before it gets to production. New updates come out monthly and there is no excuse for a brand new system to be plugged in while vulnerable. Patch management is an ongoing process.
9. Vulnerability scans
It may not sound like it's a part of patch management, but it will help you find new systems that need patching, and others that fall out of compliance. Run regular vulnerability scans against both your internal and external network to help identify new issues as they arise. Schedule them to run at least weekly, compare each new report to the last one, and investigate deltas immediately.

Including these nine best practices in your patch management strategy will help to minimize your risks, reduce your attack surface, and ensure complete compliance with security policy. Patch management is every bit as critical as change management, and requires a lot less paperwork.

This guest post was provided by Casper Manes on behalf of GFI Software Ltd. GFI is a leading software developer that provides a single source for network administrators to address their network security, content security and messaging needs. Learn more on how to make the best out of patch management.

All product and company names herein may be trademarks of their respective owners.

Read More

Review : GFI LanGuard - Network Security Scanner & Vulnerability Management Tool

I’m a firm believer in multitasking. I tend to work on several things simultaneously; the more monitors I have connected the more things I can do in parallel, and I can bounce back and forth between tasks, given that no one interrupts me. When I find an application that can do more than one thing for me, I become very interested, and when it can do three things well, I have myself a winner! GFI LanGuard is just that; a winner, that multitasks for me by providing patch management, network security, and vulnerability scanning into a unified application which makes my network maintenance tasks quick and easy. The latest version was released just a few weeks ago so I decided to take the app out for a spin, really kick the tires, and see what it has to offer. I’ll rate each area on a ten point scale, where high scores are better. Here’s how my test drive went.


0-60 in an instant
The 124MB download came down in an instant, and my trial key was in my inbox before the download was done. GFI LanGuard uses the .NET Framework 3.5 SP1, which it will prompt you to install (along with the Windows Installer 3.1 and MDAC 2.0) if not already present. Beyond that it’s only a couple of clicks and couple of minutes to have up and running. The trial lets you scan up to five ip.addrs during the 30 day evaluation period. Since scanning for and installing patches are things that require an admin account, you should have a service account with admin rights ready to go before you begin the install. I didn’t, but that was an easy fix. For ease of install and setup I give GFI LanGuard 9 out of 10.

Ride and handling
Post install the product offers to launch the management console, and starts a scan of the local system.

As you can see, it offers short cuts to a dashboard, a place to remediate issues, agent management, and scanning. Clicking on View details revealed some surprising information about the host I just built and patched up to host this app, and Windows Updates showed no missing patches.

But seeing six missing patches, I reran Windows Updates and sure enough, it found the missing patches. This could have just been a matter of timing, and the server might have updated itself this evening, but I would have signed off that the server was fully patched, and obviously it wasn’t.

The two high-security vulnerabilities flagged were a lack of antivirus software, and Windows Defender was also out of date. I clicked on the scan tab, and chose to let it go out and scan my network for other systems. It found them all within a few seconds. With a total of five machines permitted in the evaluation, I decided to add two servers and two workstations from my network. I went with the manual add since I have many more than that, but options included automatically scanning the network, and importing from a list. It’s good to have options.

The scan completed and reported the status on all of the machines, including missing patches, running software, open ports, etc.

GFI LanGuard can assess and remediate machines using an account with administrator privileges, but scans must run each time a machine is checked. You also have the option of deploying agents to managed machines, which run in the background and report system status up to the management console. This is optional, but makes checking the status of a machine faster.

Scanning does take a while. The initial scan of my five machines took almost 30 minutes. While two of the clients were on wireless, and the scanning host is a VM, I think an initial scan of a larger network could be a weekend long event or more. Pushing agents first might have been the better choice. For getting the application up and running, I give it another 9 out of 10.


Performance in the curves
Scans are a great way to go, but the real strengths show in remediation. GFI LanGuard offers several great ways to push out and roll back patches and applications.

Testing patches is critical, but sometime you won’t find an issue until a patch or update has been pushed out to clients. One of the most important parts of any patching application is the ability roll back patches, and GFI LanGuard can uninstall patches, service packs, and applications.

I pushed out patches to the Windows 7 workstations for December’s updates, and then uninstalled two of them just to try it out. Installs and uninstalls both worked smoothly, prompting the user for the required reboots each patch needed but otherwise running behind the scenes and out of sight to the user.

The straightaways
I was delighted to find that GFI LanGuard can deploy software as well. I expected it could push patches and updates, but new apps are like finding a turbo-charged 3 liter when you were expecting only a 4 cylinder 1.6. I tested this out by pushing PSPad to a workstation and it worked flawlessly. Check out the options for deployment.Applications can be deployed with or without switches, but configuration files (called auxiliary files) can be pushed out to clients without installation.

Users can be warned before the install begins using custom messages.


Post installation requirements are covered too. Letting the user decide includes setting a message.

Overall, the ability to manage software beyond patches and service packs makes GFI LanGuard a very powerful and useful addition to your network management toolset.

What about the data
GFI LanGuard offers full reporting that would satisfy the most data hungry managers. There are reports for vulnerabilities, software audits, baselines, and more. Here’s a quick snap of what you can do.

Here’s a peek at the security overview for one of my servers. Notice that all patches and service packs are good to go, but that doesn’t mean there aren’t issues. Looks like my Wireshark install needs some attention



Managers may like reports, but I love data that I can act on, and being able to see out-of-date third party applications gives me something real information so I can start assigning tasks.

In conclusion
GFI LanGuard is a worthy application and deserves a place of honor in your application suite. With the ability to patch software, update applications, generate reports, and run security vulnerability scans, this application has something to offer everyone; network and server admins, workstation support, application support, and information security personnel too. Earning an overall nine out of ten for performance, functionality, and usefulness, GFI LanGuard will be the next software purchase for my network.

Read More

BackBox Linux 2.01 released

The BackBox team is proud to announce the release 2.01 of BackBox Linux.The new release include features such as Ubuntu 11.04, Linux Kernel 2.6.38 and Xfce 4.8.0. The ISO images (32bit & 64bit) can be downloaded from the following location: http://www.backbox.org/downloads
What's new

System upgrade
Performance boost
New look
Improved start menu

Bug corrections

New sections such as Forensic Analysis, Documentation & Reporting and Reverse Engineering
New Hacking tools and updated tools such as dradis 2.8, ettercap 0.7.4.2, john 1.7.8, metasploit 4.2, nmap 5.51, set 2.5.2, sleuthkit 3.2.1, w3af 1.0, weevely 0.5, wireshark 1.6.3, etc.


System requirements

32-bit or 64-bit processor
256 MB of system memory (RAM)
4.4 GB of disk space for installation
Graphics card capable of 800×600 resolution
DVD-ROM drive or USB port

Read More

Indian Cyber Army Opens It's Services from 5th January

As we are already aware with INDDIAN CYBER ARMY.INDIAN CYBER ARMY have just posted on their blog announcing that INDIAN CYBER ARMY is going to open their training programs and services from 5th january.Lets read more on their own words:

"After a Long wait Indian Cyber Army is back again. Thanks people for your support and hold.

We are back with lots of new authorities, services, training programs. from 5th january 2012, we are opening our membership again from 5th January 2012.

We have associated with many corporates, institutions and cyber crime cells and ministries to fullfill our dreams and mission to secure digital India.

The complete details about our services and training programs are being uploaded on our official website. Kindly check that out.

To all those who previously requested for membership please do it again through website http://www.indiancyberarmy.org/.

support us and make 2012 the year of Hackers."


**For training programs help. Email: trainings[at]indiancyberarmy.org

**For Services help.Email: services[at]indiancyberarmy.org

**For Membership help.Email: membership[at]indiancyberarmy.org

**For any live support. visit http://support.indiancyberarmy.org

Read More

'PrivateX' hackers target more gov't websites

MANILA, Philippines - Hackers who defaced the website of Vice President Jejomar Binay and at least 5 other sites have warned that they will attack more government websites.

 Posts made in the past few days on the Facebook page of the PrivateX hackers' group mentioned several other government agencies.

"Expect us," said a December 29 message, with an attached article from the Department of of Social Welfare and Development.

The hacker group's founder, in an email to WorldcyberNEWS.com, said one of their members identified as "Blackrain" will answer questions about the hacking incidents soon.

The group's latest post on Monday made fun of the Department of Health by creating a page with an ASCII art showing a large nuclear explosion.

"Anonymous #OccupyPhilippines ProjectX PrivateX Philker," the message below the image said. "We are Anonymous, We are legion, We don't forgive, We don't forget."

Other government websites mentioned by the group in the page are those belonging to the Optical Media Board, the Philippine National Radiation Institute, the Senate Electoral Tribunal, the Commission on Appointments, the Philippine Racing Commission, and sites owned by the local governments of Libon, Camiguin, and Manaoag.

Some of the websites remained defaced Monday afternoon.

OVP admits website hacked

Meanwhile, the Office of the Vice President's (OVP) website has been fixed.

Joselito Salgado, head of the OVP's media affairs division, said the website has hacked by the PrivateX group around 4 p.m. on Sunday and was down for more than 15 hours.

He said the OVP's website is being hosted by the Advanced Science and Techology Institute (ASTI), an agency under the Department of Science and Technology (DOST).

"We have been informed that ASTI is looking into the incident and will put in place the needed safeguards," Salgado said.

"The OVP website provides information on the programs, projects and services of the Office of the Vice President. It also provides the public the opportunity to bring their concerns to the attention of VP Binay. Unfortunately, the hacking incident has deprived the public, particularly our Overseas Filipino Workers with a channel to communicate with the Vice President," he said.

PrivateX, in a statement, said it does not seek to taunt the OVP website's administrator "but to point out that transferring to a paid hosting doesn't mean that you are secured."

"We did not delete any file on the server but we created an index.html and redirected the index.php to index.html (Deface page)," they added.

Read More

Government assets require holistic security strategies

Information stored within the government institutions is growing manifold. This growth in data volumes is also being accompanied by the rising sophistication and targeted nature of cyber threats, says Ajay Goel from Symantec.

E-governance has become a buzzword and leverages the vast IT capital the country has created to benefit a larger population. Information stored within the government institutions (defence records, tax records, or health records) is growing manifold. This leads to increased focus on creating an IT infrastructure that can handle the rapid technological changes, as well as secure and manage growing volumes of information.

The Indian Government is undertaking various mega-projects to digitize information, with the intention to deliver services to citizens in a more streamlined and effective manner. A recent example is the UID project, considered to be one of the largest information management initiatives in the world, which brings various elements of information about citizens in a central database. This is leading to an explosion of digital information that is increasingly also dispersed across various devices such as smartphones, tablets and more significantly, the cloud.

However, growth in data volumes is also being accompanied by the rising sophistication and targeted nature of cyber threats. Symantec observed over 286 million new threats in 2010 globally, according to the latest Internet Security Threat Report XVI. The report also revealed that India ranked sixth for overall malicious activities in 2010, up from 11th in 2008.

Today, state and local governments face a challenge of securing their sensitive information in addition to modernizing infrastructure. Some of the key requirements that government institutions need to consider include:

•    Protecting confidential data residing in various endpoints, network and storage systems to reduce risks.

•    Automating key compliance and security processes to reduce risk and operational costs.

•    Recovering citizen information in response to accidental loss of data, intentional data misuse or a disaster.

Recognizing the seriousness and importance of information security, the Indian Government recently issued a directive to all Sarkari Bhavans to deploy intrusion prevention systems, with the objective of preventing attackers from entering the network.

However, government organizations first need to anticipate and identify threats. One cannot hope to have security without intelligence. Networks do not know borders and given the advent of remote users, this is becoming more evident each day. As a result information collection on attacks, techniques, methods and vulnerabilities needs to be constant and vigilant.

Along with the continuously evolving threat landscape, the insider threat to data has also become a significant danger, especially in the context of the numerous devices and platforms on which data is accessed anywhere and anytime. From the well meaning insider who clicks on a malicious link to the employee who may copy confidential information on to a thumb drive for personal benefits, the insider threat can be addressed through the technology that identifies the most valuable information and protects it no matter where it resides — at rest or in motion. Data loss prevention technology also automates the implementation of policies and reduces risky actions to create a culture of security in the organization.

Governments need to make sure that critical services/systems remain available for as long as possible and that these services/systems can be quickly recovered in the clearly defined timeframe after an attack. According to Symantec’s Critical Infrastructure Protection Survey 2010, 43 percent of Indian critical infrastructure providers said attempts to shutdown or degrade their computer network were effective. Critical Infrastructure Protection is not limited to protecting government and defense infrastructure, but extends to both publicly and privately run infrastructure such as telephone networks, power generation and distribution, oil refineries and gas pipelines. These are the industries that always need to be available and any downtime can have significant societal impact and even threaten national security.

As the pace of information growth accelerates and the digital infrastructure expands, Governments have more to manage than ever before. It now requires a focus on security continuity that allows it to continuously respond to internal and external changes.

Governments need to develop and implement an information-centric security strategy that is risk-based and policy driven, and operationalized across a well managed infrastructure. Such a strategy will help them secure and manage the connected world and deliver confidence to citizens that their information and identities are safe.

Read More

More targeted cyberattacks on gov't, multinationals seen in 2012

A dramatic increase in targeted attacks on state institutions and large companies may loom in 2012, a computer security firm said.

 

Kaspersky Lab also warned a wider range of organizations around the world may have to brace for the expected cyber onslaught.

 

"(This year), companies in the natural resource extraction, energy, transport, food and pharmaceutical industries will be affected, as well as Internet services and information security companies,” said Kaspersky Lab's Alexander Gostev, author of the report "Cyberthreat Forecast for 2012."

 

For now, he noted most attacks had targeted companies and state organizations involved in arms manufacturing, financial operations, or hi-tech and scientific research activities.

 

Gostev said the attacks will likely spread beyond Western Europe and the US and affecting Eastern Europe, the Middle East and Southeast Asia.

 

Less email, more browser attacks

 

Kaspersky Lab experts said attackers may change their methods in response to the growing competition among IT security companies that investigate and protect against targeted attacks.

 

Also driving the search for new methods is increased public attention to security lapses, they added.

 

"The conventional method of attacks that involve email attachments with vulnerability exploits will gradually become less effective, while browser attacks will gain in popularity," they said.

 

Hacktivist attacks, state support

 

The Kaspersky Lab forecast also said hacktivist attacks on state organizations and businesses will continue in 2012, with a predominantly political agenda.

 

Gostev said this will be an important trend when compared to similar attacks in 2011.

 

But hacktivism could well be used as a diversionary tactic to conceal other types of attacks, Kaspersky Lab said.

 

It said high-tech malicious programs such as Stuxnet and Duqu created with state support will remain unique phenomena.

 

"Their emergence will be dictated by international tensions between specific countries," it said.

 

Gostev said the cyber conflicts in 2012 will revolve around traditional confrontations: the US and Israel versus Iran, and the US and Western Europe versus China.

 

More basic weapons designed to destroy data at a given time, such as kill switches and logic bombs will become more popular as they are easier to manufacture.

 

"The creation of these programs can be outsourced to private contractors used by the military or other government agencies. In many cases the contractor may not be aware of the customer’s aims," Kaspersky Labs said.

 

Mobile threats, espionage

 

Kaspersky Lab said devices running Google's Android OS may remain the target of choice for the mobile malware market as well as an increase in the numbers of attacks that exploit vulnerabilities.

 

It also forecast the emergence of the first mobile drive-by attacks and mobile botnets.

 

"Mobile espionage will become widespread and will most probably include data theft from mobile phones and the tracking of people using their telephones and geolocation services," it said.

Read More

EU urges India to join ¤52.5b worth cyber security project

European Union (EU) has invited India to participate in a mega cyber security and cyber crime project worth ¤52.5 billion (Rs 3.62 lakh crore) to secure economic and security interests of various countries globally.

India has been asked to join a select group of nations to be involved in this research and information technology driven innovation project. Apart from US, Brazil and South Africa are other partners of EU in this project that will be kicked off shortly.

The project that has counter-terrorism as a key component is likely to be part of a separate pact that EU and India will sign early next month at the twelfth summit between two sides.

Neither China nor Russia, two other key members of BRICS have been invited to join this mega project.

As per the proposed pact, India and EU apart from other members would jointly fund as well as research on cyber crime and cyber security issues across the world.

The project is intended to develop protocols and systems for preventing terror attacks physically and on information highway, an external affairs ministry official told Financial Chronicle on condition of anonymity.

This massive project to be implemented over next eight years include securing electrical power systems by identifying the vulnerability, put in place defence systems and restoration in case of disruption. The project will also lead to protection of critical defence and civilian economic infrastructure from cyber attacks.

Risk prediction, analysis and reaction to critical infrastructure, is also expected to be put in place through this project. Private, public sector companies and government agencies would be involved in this project.

Two rounds of consultation have already been completed between both India and EU on concluding the cyber crime and cyber security pact in February 2012.

This follows the initial discussion between India’s national security advisor Shivshankar Menon and EU high representative for foreign affairs and security policy Catherine Ashton in December 2010.

India and European Union will explore cooperation between CBI and EU’s home department for training on tackling cyber crime, establish single point of contact and also do joint research in the mega innovation project.

Read More

Tracked with his hack

COIMBATORE: Although he is not part of the police establishment, S N Ravichandran's expertise on the computer and internet helps investigating officials arrest those indulging in cyber crimes.

Whenever a major cyber crime happens in the city, this entrepreneur turned IT expert gets very busy.

Ravichandran's mission is to help police detect the origin of the offensive material. He can decipher the exact location of the computer from which the defamatory material has emerged. As a man who firmly believes in the judicious use of internet, this member of Cyber Society of India(CySI) extends his service free of charge to the police. He proves cases by tracing passwords and collecting details from the cyber world.

Ever since the cyber crime wing was launched at the City Police Commissioner's office five years ago, Ravichandran has been helping them crack complex cyber crime cases. Managing Director of Nilgiris Chemicals Stoneware Co. Private Limited, which exports ceramic goods, Ravichandran spends equal time on his profession and service to the police. Encouraged by his success in solving cases, Ravichandran now plans to undertake awareness programmes on cyber security in schools and colleges.

"A few computer training centers have started offering courses in ethical hacking. There is risk involved here as youth may misuse hacking technology. The state government should limit ethical hacking to those in investigative agencies. Otherwise, it must be controlled and closely monitored by the state government," said Ravichandran.

School going children, working women and house wives are often victims of the cyber crimes, he says. "Cyber criminals may upload their photo on porn sites and take advantage of them with morphing technology. It is risky to upload your picture on social networking sites as it becomes available to all, some of whom may misuse it. Thus youth should be cautious about uploading their pictures on the internet," said Ravichandran. He also warns against responding to dubious emails including job offers.

Read More

'Spam capital' India arrests six in phishing probe

Police in India say they have arrested six foreign nationals suspected of defrauding hundreds of people using text message and email scams.

Scam victims were duped after being told they had won a lottery.

Authorities seized 14 laptops, seven memory sticks and 23 mobile phones, as well as fake documents and cash.

The arrests come after security firm Kaspersky reported that India now sent more spam than any other country in the world.

Police said the six men, all Nigerian, would be remanded in custody until 12 January.

The arrests signal attempts to crack down on a growing cybercrime problem in the region.

Mumbai-based internet security specialist Vijay Mukhi said poor enforcement of laws meant spammers could act with impunity.

"We have an Information Technology Act that was introduced in 2000. But we don't have any convictions under it and it's silent on spam," he said.

"If I'm a spammer, I would rather spam from India to India and the rest of world because nothing will happen to me."

Free reign

In its report, Kaspersky said 14.8% of all spam email sent in the three months prior to the end of September had originated in India.

Darya Gudhova, Kaspersky's spam analyst, said a lack of security awareness had given spammers free reign.

She added that there was a growing level of cybercrime activity in developing regions such as Asia and Latin America.

The Internet and Mobile Association of India (IMAI) estimates that the country has more than 112 million internet users, the third largest in the world after the US and China.

About seven million new users are being added every month, the IMAI said.

David Emm, a security researcher from Kaspersky Labs, said this growth was making life difficult for the authorities - but believed the arrests signalled a strong sign of intent from the Indian government to get a grip on scammers.

"One of the good things is that they are taking it as a serious issue," he told the BBC.

"Cybercrime activity is breaking out of the western European theatre and starting to affect other parts of the globe because of the massive growth in IT.

"[In Europe] we've had cybercrime legislation for a long time with lots of expertise and history of dealing with it - but if you go to other areas like Brazil or India, you find they don't necessarily have specific cybercrime legislation."

Read More

No Shelter From a Cybercrime Storm

Anonymous hackers let fly with the information they pilfered from Stratfor, dumping on the Web for all to see Friday. Hundreds of thousands of usernames, email addresses and hashed passwords were included. SpecialForces.com, a site that sells military clothing and personal gear, also found itself in hackers' crosshairs.

The Anonymous hacker collective has run riot this holiday season, and security experts predict more pain from cybercriminals at large for the coming year.

Anonymous also announced earlier that it had cracked the systems of gear vendorSpecialForces.com on Tuesday.

As a follow-up to its breach of private think tank Stratfor's systems last week, the hacker collective, or its stepchild Antisec, dumped all the information stolen from the Stratfor break-in on the Web on Friday.

This includes 75,000 names, addresses, and MD5 hashed passwords of all Stratfor's paying customers, as well as about 860,000 usernames, email addresses and hashed passwords for everyone who's ever registered on Stratfor's site. It's not clear whether there's any overlap between the two categories.

MD5, the Message-Digest Algorithm, is a widely used cryptographic hash function used in various security applications and to check data integrity that's been declared unsuitable for further use by the United States Computer Emergency Readiness Team (US-CERT) because of its vulnerabilities.

Stratfor's Followup

Stratfor has taken its website offline and is using technology from CSID to provide 12 months of free identity protection services to victims of the hack into its systems, CSID told TechNewsWorld.
The company's clients include various government agencies and businesses in the United States and abroad. Among them are the United States Army, the U.S. Department of Homeland Security, Google (Nasdaq: GOOG), Apple(Nasdaq: AAPL), Microsoft (Nasdaq: MSFT), Air New Zealand and four Australian banks.
Anonymous also reportedly turned its guns on people who spoke up in support of that Stratfor.

Blitzkrieg on SpecialForces.com

Anonymous apparently hacked the SpecialForces.com website back in August, although it's only making this public recently.
The collective claims it has had about 14,000 passwords and information from 8,000 credit cards from the website's members. It stole the keys to crack encrypted data on SpecialForces.com's servers.
Special Forces Gear, which owns the website, reportedly said the passwords stolen are more than a year old and most of the credit card numbers have expired.
The company has reportedly rebuilt its website and implemented new security measures.

Taking Care of Business

Perhaps Stratfor and SpecialForces.com should have taken more stringent security measures from the outset.
It is indeed possible to stop even determined hackers, suggested Andrew Brandt, director of threat research at Solera Networks Research.
"It just takes a guard or team of guards, equipped with the right tools to get the job done, and an equal or greater degree of determination, to stop them," he told TechNewsWorld.

Hash Table Vulnerability's a Global Website Threat

Meanwhile, a hash table vulnerability that could trigger a flood of denial of service (DDoS) attacks has been found by security researchers Nruns.


The vulnerability was believed to only affect hash tables in Perl and CRuby when first discovered in 2003, but nruns has found that it also affects other mainstream Web dev platforms such as Java, ASP.NET, PHP 5 and Google's v8.


Ruby and Perl are rapid prototyping languages, while Java "is the technology of choice for massive enterprise-grade systems like [those used in] online banking," Jeff Schmidt, CEO ofJAS Global Advisors, told TechNewsWorld.


"Monitor and keep up to date on vendor patches," Schmidt advised.
Microsoft issued Security Bulletin MS 11-100 on Thursday to patch the vulnerability in ASP.NET. The patch will be automatically updated and installed on systems that have the automatic updating feature turned on.


"While we have seen no attacks attempting to exploit this vulnerability, we encourage affected customers to test and deploy the update as soon as possible," Dave Forstrom, director of Microsoft Trustworthy Computing, told TechNewsWorld.


PHP has also published a patch for this vulnerability, Qualys Chief Technology Officer Wolfgang Kandek said.

New Cybersecurity Efforts Coming

January will mark the launch of the National Critical Infrastructure Cybersecurity Education Initiative. This aims to develop cybersecurity education programs jointly between the private and public sectors. It also calls for the completion of critical infrastructure frameworks by 2012.


The initiative is being led by the Global Institute for Cybersecurity + Research (GICSR).
The Federal government "needs to incorporate secure configurations and system configuration baselining as a core part of any recommendations for improving security," Dwayne Melancon, chief technology officer at Tripwire, told TechNewsWorld.


"Regardless of the industry -- the Federal government or the commercial sector -- I see a lot of enterprises [that] have documented processes and standards which aren't being followed effectively," Melancon said.

Read More